‹ Back to the current feed
How this archive is made. The current feed is compiled automatically twice a day by an AI model that searches recent reporting from named public sources. Each item is added to the archive once, on the day it first appears. A person does not review each item before it is published, so check the linked source before you act on any detail.
October 26, 2026
Automated summary. The most urgent development of the past 24 to 48 hours is the confirmed active exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). A researcher reported over the weekend that attackers successfully launched 35 shells across honeypot servers on October 24, with traffic closely matching a public proof-of-concept exploit. Mirai botnet operators have also joined the attack wave, and industrial vendors including Siemens, Schneider Electric, and ABB have confirmed that some of their products are affected. CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, and governments worldwide are urging immediate patching to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Organizations that cannot patch immediately are advised to take PHP-based systems offline.
Also published today, Wiz Research disclosed the Gheist supply chain campaign, an ongoing automated operation that has used stolen GitHub tokens to plant secret-dumping workflows across more than 13,500 branches in over 850 compromised GitHub accounts since September 15, 2026. The attack has succeeded in private repositories and GitHub Enterprise environments, and follow-on cloud activity including AWS Secrets Manager enumeration has been observed in enterprise victims. Separately, Microsoft has attributed the October ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned threat actor, which used the ARTEX agentic AI penetration testing framework to attempt sign-ins across more than 2,250 Microsoft 365 tenants at machine speed, achieving privileged access at some organizations in under three hours.
Beyond these lead stories, the UEFI bootkit BlackX was publicly documented this week targeting diplomatic organizations in Central Asia, exploiting the years-old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot on fully patched Windows systems where firmware revocation steps had not been applied. The FBI and CISA joint advisory AA26-293A on SafePay ransomware, issued October 20, confirmed that the group has hit at least 600 organizations across critical infrastructure sectors since August 2024 and deliberately destroys backup copies before encrypting systems. Security teams should treat all of these developments as requiring immediate action rather than routine scheduling.
CRITICAL
Storm-0940 / ARTEX AI-Driven Supply Chain Attack on ConnectWise Cloud Backup Targeting 2,250+ Microsoft 365 Tenants#
Microsoft Threat Intelligence attributed a supply chain compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat actor, on October 21, 2026. The group weaponized ARTEX, an open-source agentic AI penetration-testing framework, to automate password-spraying at up to 2,900 sign-in attempts per minute, generating more than 151,000 failed logon events before gaining access on October 15 via compromised ConnectWise cloud application credentials. The compromised application context allowed the actor to attempt sign-ins to more than 2,250 downstream Microsoft 365 customer tenants, with Microsoft warning that credential modifications made by the agents can persist as backdoors even after the original application is remediated.
APT
CRITICAL
LiteLLM 1.107.0 Supply Chain Attack - Credential Stealer and Backdoor via PyPI and Docker Hub#
On October 21, 2026, attackers compromised the LiteLLM release pipeline via stolen GitHub CLI OAuth tokens and published malicious version 1.107.0 to PyPI and official Docker images for approximately two hours before removal. The payload used Python startup hooks so that any environment with the package installed would execute the credential stealer on every Python invocation without needing to import LiteLLM; it harvested cloud credentials (AWS, Azure, GCP, Kubernetes), AI provider API keys, developer secrets, and browser data, then exfiltrated them to attacker-controlled infrastructure while establishing an hourly remote code execution polling loop. SecurityWeek reported the malicious packages are estimated to have been downloaded over 49,000 times during the exposure window.
Malware
CRITICAL
Storm-0940 APT - ARTEX AI-Powered ConnectWise Supply Chain Attack#
Microsoft attributed the October 2026 ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned threat actor active since at least 2021. According to Microsoft, the actor used ARTEX, an agentic AI penetration testing framework, to automate password spraying at approximately 2,900 attempts per minute, targeting more than 2,250 Microsoft 365 tenants; in several cases privileged cloud access was achieved in under three hours of initial targeting. ConnectWise subsequently suspended Cloud Backup, SaaS Security, and Cloud Management services in response.
APT
CRITICAL
SafePay Ransomware - CISA/FBI Joint Advisory AA26-293A#
The FBI, CISA, the U.S. Secret Service, and international partners issued joint advisory AA26-293A on October 20, 2026, warning that the SafePay ransomware group has hit at least 600 organizations across critical infrastructure sectors since August 2024. According to the advisory, the group gains initial access through compromised or guessed credentials, phishing, and exploitation of VPN and edge devices, then performs double-extortion by exfiltrating data before encrypting systems and deliberately deleting shadow copies and resetting network-attached storage backup devices. The advisory covers victims in North America, South America, Europe, and Australia.
Ransomware
HIGH
Quest Diagnostics Data Breach - Unauthorized Access to Quanum Lab Services Manager Exposes Patient Records#
Quest Diagnostics disclosed via an SEC Form 8-K filed October 22, 2026 that an unauthorized party accessed its Quanum Lab Services Manager (LSM) system, a platform used by healthcare clients to place test orders and retrieve results, after the company discovered the intrusion on October 21. The company confirmed on October 23 that protected health information and personally identifiable information were involved, though the number of affected patients and specific data fields have not yet been determined. Federal law enforcement has been notified and external cybersecurity experts are assisting the investigation; the full scope of the breach remains under investigation.
Data Breach
HIGH
ShinyHunters - FBI Investigation Finds Suspected Links to Ransomware Negotiation Executives; Canadian Co-Founder Arrested#
KrebsOnSecurity reported on October 19, 2026 that FBI investigators suspect executives at two different ransomware negotiation firms maintained unusually close relations with ShinyHunters and that an executive at a large U.S. consulting firm allegedly helped operate the group's victim extortion website shinywire[.]com. No charges have been filed against the unnamed U.S. executive, and KrebsOnSecurity withheld identifying details on that basis. Separately, the co-founder of a Canadian cybersecurity firm was arrested by the FBI on October 9 in connection with the ShinyHunters investigation; charges are allegations and no conviction has occurred. According to KrebsOnSecurity, the FBI attributes more than $70 million in 2026 payments to the group. Charges are allegations; the source reports no conviction.
APT
HIGH
eMudhra Compromised TLS Certificates Blocked by Major Trust Stores - Eight Certificates with Exposed Private Keys#
SecurityWeek and Schneier on Security reported on October 21-23, 2026 that major browsers and root programs have begun blocking eight eMudhra intermediate CA certificates after the private keys associated with them were found to be compromised. Python also added these compromised certificates to a denylist in its ssl module (CVE-2026-115557, CVSS v4 9.4 per securityfocus.com) so they will be automatically rejected regardless of SSLContext policy. Organizations relying on certificates issued through the affected eMudhra intermediates should replace them immediately, as any TLS sessions using them can no longer be trusted.
Vulnerability
HIGH
BlackX UEFI Bootkit - Secure Boot Bypass via Baton Drop (CVE-2022-21894)#
Kaspersky researchers documented a new UEFI bootkit called BlackX, deployed in an espionage campaign in early 2026, which exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load a malicious driver designed to interfere with security software including solutions from Kaspersky and Avast. Kaspersky found that affected systems had received Windows operating system updates but the required Secure Boot revocation measures, specifically adding the Windows Production PCA 2011 certificate to the firmware blocklist, had not been applied, leaving the bootkit able to exploit pre-patch signed bootloaders. BleepingComputer reported on October 24 that the campaign targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan; the attribution to APT41 carries medium confidence per Kaspersky.
APT
HIGH
Gheist Campaign - Stolen GitHub Tokens Harvesting Cloud Secrets at Scale#
Wiz Research disclosed on October 26, 2026, that an automated campaign tracked as Gheist has been using stolen GitHub tokens since September 15, 2026, to plant a malicious GitHub Actions workflow named sync-check across accessible repositories, printing base32-encoded secrets into workflow logs and exfiltrating them via the GitHub API before deleting the runs. The campaign has affected more than 850 compromised accounts and planted more than 13,500 branches, with follow-on activity in enterprise environments including AWS Secrets Manager enumeration using harvested cloud credentials. Dark Reading reported that GitHub's approval controls protect public repositories but private and enterprise repositories remain at risk; Wiz linked token sources to infostealer logs and earlier supply chain attacks.
Malware
HIGH
Microsoft .NET Emergency Patch - Critical Brotli Flaw CVE-2026-111497#
Microsoft released emergency out-of-band security updates on October 25 and October 26, 2026, for a critical vulnerability tracked as CVE-2026-111497 and also referred to as Broccoli2Shell and HTTP2Shell, affecting the Brotli C decoder library built into .NET and Node.js. Microsoft rates the flaw Critical with a CVSS v3.1 score of 8.1, classifying it as an out-of-bounds write that can lead to elevation of privilege; the advisory notes no user interaction is required and the attack vector is network-reachable with high complexity. BleepingComputer reported on October 26 that the patches cover .NET 8, 9, and 10, and that the upstream Google Brotli library record was published in NVD on October 22.
Vulnerability
HIGH
Capcom disclosed on October 22, 2026, that unauthorized access to its CAPCOM ID service exposed information associated with approximately 11,774,247 accounts, and SecurityWeek reported that attackers also changed login passwords for 196 accounts. According to SecurityWeek, the hackers stole approximately 11 million email addresses, and while passwords were reportedly not stolen for most accounts, the combination of account metadata and email addresses creates phishing and credential-reuse risk for affected users. BleepingComputer independently confirmed the incident on the same date.
Data Breach
October 25, 2026
Automated summary. The most pressing development of the past 48 hours is the continued mass exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution vulnerabilities affecting virtually every PHP installation serving web requests. Patches shipped on October 21, but exploitation attempts were detected as early as October 17 -- before public disclosure -- and honeypot networks confirmed active in-the-wild exploitation on patch day itself. CISA updated its alert on October 23 with new detection rules, and government websites across Europe went offline as organizations scrambled to apply fixes. The breadth of exposure is significant: PHP underpins roughly 70 percent of websites, including WordPress, Drupal, Joomla, and Magento deployments, making this the highest-priority patching event of the quarter.
Also newly disclosed this week, Microsoft attributed the mid-October ConnectWise Cloud Backup supply chain breach to Storm-0940, a China state-aligned threat actor, and confirmed the group used ARTEX -- an open-source agentic AI penetration-testing framework -- to automate password spraying at 2,900 sign-in attempts per minute against more than 2,250 Microsoft 365 tenants. In several confirmed cases, the adversary went from initial targeting to privileged cloud access in under three hours. Separately, the open-source AI gateway LiteLLM was compromised on October 21 via stolen GitHub OAuth tokens; malicious version 1.107.0 was live on PyPI and Docker for approximately two hours and is estimated to have been downloaded over 49,000 times before removal. The payload stole cloud credentials, AI provider secrets, and developer keys, underscoring escalating supply chain risk within AI infrastructure.
On the ransomware front, CISA, the FBI, and international partners published joint advisory AA26-293A on October 20, detailing SafePay ransomware tactics and disclosing that the group has compromised approximately 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. A third actively exploited zero-day in four months was also disclosed for Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9 on CVSS 3.1), threatening enterprise SD-WAN management planes globally. Organizations should treat these items as concurrent, high-urgency response priorities, as adversaries are demonstrably moving faster this week by leveraging AI-driven automation.
CRITICAL
Microsoft attributed the mid-October supply chain compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat actor active since at least 2021, according to Microsoft's October 21 disclosure as reported by SecurityWeek. Microsoft states that Storm-0940 used ARTEX, an open-source Go-based agentic AI penetration testing framework, to automate password spraying, reconnaissance, and OAuth application abuse, targeting more than 2,250 Microsoft 365 tenants; in some cases, privileged cloud access was achieved in under three hours of initial targeting. The attribution and the AI tool angle are Microsoft's assessment; the ConnectWise incident itself is confirmed by ConnectWise's own advisory and independent responders, and the Chinese embassy disputed the characterization as reported by SecurityWeek.
APT
CRITICAL
Eight intermediate certificate authority certificates issued by Indian CA eMudhra were found on October 17, 2026 to carry P-384 private keys with values smaller than 256, meaning any party could recover them in under a second from the public certificates, as reported by BleepingComputer and covered by Schneier on Security. Mozilla, Google Chrome, Apple, and Microsoft blocked the affected certificates by October 21; any holder of the recovered keys could have issued browser-trusted certificates for any website. eMudhra attributed the flaw to a bug in its key-generation ceremony script from April 2025, stated no intrusion into its systems occurred, and on October 22 announced its exit from the global public TLS certificate business. No confirmed malicious use had been publicly reported as of October 22, though the keys were in place for approximately 18 months.
Vulnerability
CRITICAL
Storm-0940 China-Aligned APT Uses ARTEX AI Agents in ConnectWise Supply Chain Attack#
Microsoft attributed the mid-October compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat actor active since at least 2021, in a report published October 21. The actor used ARTEX, an open-source agentic AI penetration-testing framework, to automate password spraying at approximately 2,900 sign-in attempts per minute and target more than 2,250 Microsoft 365 tenants; in several documented cases the adversary moved from initial targeting to privileged cloud access in under three hours. Microsoft assessed that the actor abused ConnectWise Cloud Backup application OAuth credentials to authenticate into downstream customer environments without interactive user sign-in.
APT
HIGH
HPE ArubaOS Eight Maximum-Severity (CVSS 10.0) RCE and Authentication Bypass Flaws#
HPE published security bulletin HPESBNW05162 on October 22, 2026, addressing 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), including eight flaws rated CVSS 10.0 involving unauthenticated remote code execution and authentication bypass, as reported by BleepingComputer. The maximum-severity flaws affect Mobility Conductors, Controllers, Gateways, and Access Points and can be exploited remotely with no privileges and no user interaction; HPE reported no known public exploit code or active exploitation at the time of advisory publication. HPE advises customers to upgrade to fixed releases and restrict CLI and web management interfaces to a dedicated VLAN or firewall them.
Vulnerability
HIGH
LiteLLM Supply Chain Attack: Malicious PyPI and Docker Packages Distribute Credential Stealer#
On October 21, 2026, attackers compromised the LiteLLM project's release pipeline using stolen GitHub CLI OAuth tokens and published malicious version 1.107.0 to PyPI and Docker Hub, as reported by SecurityWeek and BleepingComputer. The tampered packages, which were available for approximately two hours on PyPI and longer on Docker registries, contained a credential stealer targeting cloud provider tokens (AWS, Azure, GCP), AI provider API keys, developer secrets, and environment variables, as well as a remote code execution loader; SecurityWeek reports the packages were downloaded an estimated 49,000 times. LiteLLM states that enterprise customers pulling from its private repository were not affected, and all malicious artifacts have been removed; affected users are advised to rotate all secrets and upgrade to a clean release.
Malware
HIGH
SafePay Ransomware: CISA Joint Advisory AA26-293A -- Approximately 600 Critical Infrastructure Victims#
CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency jointly published advisory AA26-293A on October 20 detailing SafePay ransomware activity. According to the advisory, SafePay actors have compromised approximately 600 organizations in critical infrastructure sectors across North America, South America, Europe, and Australia since August 2024. Actors gain initial access through stolen or guessed credentials, phishing via Mullvad VPN IP addresses, and exploitation of known CVEs in edge devices and VPNs; post-compromise, they use Mimikatz, PsExec, and RDP for lateral movement, archive and exfiltrate data with WinSCP and RClone, then encrypt files using ChaCha20 and RSA after factory-resetting NAS backup devices to inhibit recovery.
Ransomware
HIGH
LiteLLM v1.107.0 Supply Chain Attack -- Credential Stealer and Backdoor via PyPI and Docker#
On October 21, attackers used stolen GitHub CLI OAuth tokens belonging to LiteLLM engineers to inject a credential stealer and persistent backdoor into LiteLLM version 1.107.0, publishing the malicious package to PyPI and Docker Hub through the project's official release pipeline. The malware -- which executed automatically at Python interpreter startup via a rogue startup hook, without requiring an explicit import -- harvested cloud credentials (AWS, Azure, GCP), AI provider API keys, SSH private keys, browser data, and environment variables before exfiltrating them to attacker-controlled infrastructure. BleepingComputer reported the malicious packages were estimated to have been downloaded over 49,000 times during the approximately two-hour exposure window before removal; SecurityWeek and LiteLLM's own incident report confirmed credential theft and follow-on cloud credential use were observed as of October 22.
Malware
HIGH
ShinyHunters Extortion Investigation: FBI Probes Suspected Ransomware Negotiator Ties#
KrebsOnSecurity reported on October 19 that FBI investigators pursuing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who maintained close relations with the extortion group; investigators believe at least one U.S.-based consulting firm executive actively helped operate ShinyHunters' victim extortion website shinywire[.]com. KrebsOnSecurity withheld the executive's name and the company's identity because no charges had been filed as of publication. The publication separately reported the FBI attributes more than $70 million in 2026 payments to the ShinyHunters group, which steals credentials through phishing and threatens to publish stolen data unless victims pay, without encrypting files.
Other
MEDIUM
Compromised TLS Certificates -- Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys#
Schneier on Security flagged on October 23 that major technology companies have moved to block certificates issued by eMudhra, a Certificate Authority, after eight compromised cryptographic keys were identified. The action reflects ongoing concerns about trust-anchor integrity in the global TLS certificate ecosystem. Organizations relying on eMudhra-signed certificates for internal or customer-facing services may experience connectivity disruptions or browser trust errors and should reissue certificates under a trusted CA as a priority.
Vulnerability
October 24, 2026
Automated summary. The most acute development of the past 48 hours is the active exploitation of two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. CISA updated its advisory on October 23 to add a SIGMA detection rule and reinforce mitigation guidance, while Amazon Threat Intelligence reported that exploitation attempts began four days before patches were released on October 21. The flaws affect all PHP installations serving web requests across multiple server technologies, and organizations are urged to update immediately to patched versions or take PHP-based systems offline if patching is not immediately possible. A third PHP RCE flaw, CVE-2026-115560, was disclosed on October 23 without a patch available, compounding pressure on defenders managing PHP-dependent web infrastructure.
Also newly disclosed on October 23, HPE published security bulletin HPESBNW05162 covering 72 vulnerabilities in ArubaOS, including eight flaws rated CVSS 10.0 (CVSS v3.1) that allow unauthenticated remote attackers to execute code or bypass authentication on enterprise wireless infrastructure with no user interaction required. This follows closely on Microsoft's October 21 attribution of the ConnectWise Cloud Backup supply chain compromise to the China state-aligned actor Storm-0940, which used an agentic AI framework called ARTEX to automate password spraying at up to 2,900 sign-in attempts per minute against more than 2,250 Microsoft 365 tenants. ConnectWise suspended its Cloud Backup service following disclosure.
The CISA SafePay ransomware advisory, published October 20, warns that the group has been active since August 2024 and is targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. The Plex2Shell exploit chain, a set of four chained Plex Media Server vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog on October 20, is being actively used to deploy cryptocurrency miners and proxy malware on unpatched internet-facing servers. Oracle's October 2026 Critical Patch Update, released October 22, addressed 1,209 unique CVEs including 95 rated critical, according to analysis by Tenable, making patch prioritization a significant operational burden for enterprise teams this week.
CRITICAL
HPE ArubaOS - Eight CVSS 10.0 Unauthenticated RCE and Auth Bypass Flaws (CVE-2026-79844 through CVE-2026-79851)#
HPE security bulletin HPESBNW05162, published October 22, patches 72 vulnerabilities in ArubaOS, including eight flaws carrying the maximum CVSS v3.1 score of 10.0 that allow remote attackers to bypass authentication or execute arbitrary code without credentials and without user interaction through low-complexity attacks. The eight critical flaws span authentication bypass leading to RCE, unauthenticated command injection, unauthenticated buffer overflow, and unauthenticated SQL injection in both AOS-8 and AOS-10. A separate flaw tracked as CVE-2026-79855 in the AOS-8 SSH daemon carries a CVSS v3.1 score of 9.8 and allows unauthenticated attackers to gain administrative privileges, per reporting by BleepingComputer.
Vulnerability
CRITICAL
Storm-0940 ConnectWise Supply Chain Attack Using ARTEX Agentic AI Framework#
Microsoft Threat Intelligence on October 21 attributed a supply chain compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat actor, which used an agentic AI penetration testing framework called ARTEX to automate password spraying at up to 2,900 sign-in attempts per minute, targeting more than 2,250 Microsoft 365 tenants. Microsoft reports the actor generated more than 151,000 failed logon events and that backdoor credential modifications made in victim environments can persist even after the compromised application is remediated. ConnectWise disclosed unauthorized access on October 16 and subsequently suspended its Cloud Backup, SaaS Security, and Cloud Management services.
APT
HIGH
CISA StopRansomware Advisory AA26-293A: SafePay Ransomware Targeting Critical Infrastructure#
CISA published advisory AA26-293A on October 20 detailing recent activity by the SafePay ransomware group, which has been active since August 2024 and targets businesses and critical infrastructure across North America, South America, Europe, and Australia. The advisory provides indicators of compromise, known tactics, and incident response actions to reduce risk. Organizations in critical infrastructure sectors are urged to apply the mitigations and review the full advisory.
Ransomware
MEDIUM
CISA ICS Advisories - 20 Industrial Control Systems Advisories Including Siemens and InterSystems IRIS for Health#
CISA released 20 ICS advisories on October 22 covering vulnerabilities in a broad range of industrial and healthcare control systems. The advisories include a medical advisory for InterSystems IRIS for Health (ICSMA-26-295-01) and 17 advisories covering Siemens products including SIMATIC S7 PLCs, RUGGEDCOM CROSSBOW, WinCC, APOGEE, TALON, Desigo PXC and PXM products, and Industrial Edge devices. Security teams supporting OT and healthcare environments should review the full advisory set for technical details and mitigations relevant to their deployed equipment.
Vulnerability
October 23, 2026
Automated summary. The most active threat dominating the last 48 hours is PHP2Shell, a pair of critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, each scoring 9.2 on the CVSS scale as reported by SecurityWeek) affecting PHP versions 5 through 8. Emergency patches were released on October 21, exploitation attempts began as early as October 17 before patches were available, and Mirai botnet operators are now attempting to weaponize the flaws. CISA issued a standalone alert calling for immediate patching. Separately, Arista Networks disclosed and patched CVE-2026-114625 on October 22, a CVSS 9.9 SQL injection zero-day in VeloCloud Orchestrator that has been actively exploited in the wild and enables any authenticated user to escalate to operator-level privileges across enterprise SD-WAN infrastructure.
On the ransomware front, the FBI, CISA, the U.S. Secret Service, and German and UK law enforcement released joint advisory AA26-293A on October 20 detailing the SafePay ransomware group, which has targeted at least 600 organizations across critical infrastructure sectors globally since August 2024, according to the advisory. SafePay operators routinely destroy backups before encryption to eliminate recovery options. Also still unresolved is the BeyondTrust Remote Support zero-day (CVE-2026-102764, CVSS 9.3), which SecurityWeek attributed to the Chinese APT group Armory Castle; the flaw was exploited as a zero-day from August 29 onward and was added to the CISA Known Exploited Vulnerabilities catalog on October 16.
Additional significant developments include the Atlassian multi-product pre-authentication file read vulnerability (CVE-2026-21589), added to the CISA KEV catalog on October 15 with a confirmed active exploitation status, affecting eight self-managed Atlassian products. A data breach at the State Bank of India was reported by Dark Reading on October 23, with the organization acknowledging 3,897 customer records leaked online. The Record also reported on October 23 that Quest Diagnostics is warning of potential data theft following an attack on a lab service system, further illustrating ongoing pressure on the healthcare and financial services sectors.
CRITICAL
Storm-0940 (China-Aligned APT) Uses ARTEX AI Framework in ConnectWise Cloud Backup Supply Chain Attack#
Microsoft assessed that Storm-0940, a China state-aligned threat actor, was responsible for a supply chain compromise of ConnectWise Cloud Backup. The group used ARTEX, a Go-based agentic AI penetration-testing framework, to automate password spraying at approximately 2,900 sign-in attempts per minute, targeting more than 2,250 Microsoft 365 downstream customer tenants. In multiple instances, privileged cloud access was achieved in less than three hours after initial targeting, according to Microsoft's analysis.
APT
CRITICAL
SafePay Ransomware: Joint CISA-FBI Advisory AA26-293A Documents 600-Plus Victims Across Critical Infrastructure#
CISA, the FBI, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom published joint advisory AA26-293A on October 20, 2026, warning that SafePay ransomware has impacted at least 600 victim organizations from multiple critical infrastructure sectors since August 2024. SafePay actors gain access through stolen or guessed credentials, phishing, exploitation of edge device vulnerabilities, and VPN abuse, and have been observed deleting shadow copies and resetting network-attached storage devices containing backups to obstruct recovery, according to the advisory. The advisory is the product of FBI, USSS, and German police investigations with findings as recent as August 2026.
Ransomware
CRITICAL
Storm-0940 AI-Assisted ConnectWise Supply Chain Attack Targets 2,250+ Microsoft 365 Tenants#
Microsoft attributed a supply chain compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat actor, which used stolen application credentials and an agentic AI penetration-testing framework called ARTEX to attempt sign-ins against more than 2,250 downstream Microsoft 365 customer tenants at up to 2,900 sign-in attempts per minute. In multiple cases the group obtained privileged cloud access in under three hours from initial targeting. ConnectWise disclosed the unauthorized access on October 16 and subsequently suspended its Cloud Backup service.
APT
CRITICAL
SafePay Ransomware Hits 600+ Critical Infrastructure Organizations; CISA Issues Joint Advisory AA26-293A#
CISA, the FBI, the U.S. Secret Service, and international partners published joint advisory AA26-293A on October 20, warning that the SafePay ransomware group has targeted at least 600 organizations across multiple critical infrastructure sectors since August 2024. SafePay, which operates as a private group without affiliates, gains initial access through credential abuse, brute force, VPN exploitation, and edge-device vulnerabilities, then destroys backup systems to obstruct recovery. The advisory provides indicators of compromise and tactics drawn from investigations conducted as recently as August 2026.
Ransomware
CRITICAL
CVE-2026-114625 - Arista VeloCloud Orchestrator SQL Injection Zero-Day Actively Exploited#
Arista Networks disclosed and patched CVE-2026-114625 on October 22, a SQL injection zero-day in VeloCloud Orchestrator (VCO) On-Premises deployments rated CVSS 9.9 on the CVSS 3.1 scale per SecurityWeek. The flaw allows any authenticated user, including those with the lowest built-in read-only role, to escalate to operator-level superuser privileges through low-complexity SQL injection, threatening the confidentiality, integrity, and availability of SD-WAN infrastructure. Arista confirmed active exploitation from two attacker-controlled IP addresses and noted this is the third exploited zero-day in VCO since July 2026, per SecurityWeek.
Vulnerability
CRITICAL
SafePay Ransomware - CISA Joint Advisory AA26-293A: Critical Infrastructure Targeted Globally#
CISA, the FBI, the U.S. Secret Service, and German and UK law enforcement partners released joint advisory AA26-293A on October 20, 2026, detailing SafePay ransomware, which has targeted at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024, per the advisory. SafePay actors gain access via stolen or guessed credentials, phishing, and exploitation of edge devices including VPNs and firewalls, then destroy backups before deploying encryption. The advisory maps SafePay tactics to MITRE ATT&CK and provides indicators of compromise and mitigation guidance.
Ransomware
HIGH
Lazarus Group Operation FlashHole Uses Post-Quantum ML-KEM Cryptography for Malware Payload Delivery#
Kaspersky researchers attributed a campaign dubbed Operation FlashHole to the Lazarus Group, a North Korea-linked threat actor, reporting that the group used the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism to encrypt communications between its LPEClient malware and command-and-control servers, making payload interception and future decryption significantly harder. The campaign targets South Korean organizations across the software, construction, and wired communication equipment manufacturing sectors through a multi-stage infection chain that begins with spear-phishing pages directing victims to malicious GitHub repositories. Kaspersky identified at least three affected South Korean organizations and reported that activity began in July 2025, with the post-quantum mechanism observed as early as September 2024.
APT
HIGH
ShinyHunters Extortion Network: FBI Investigates Ransom Negotiator Involvement; Executive Arrested#
KrebsOnSecurity reported on October 19 that U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, and that one executive is suspected of helping operate a website used to pressure victims into paying ransoms. On October 9, KrebsOnSecurity reported that the FBI arrested Edward Dubrovsky, co-founder of a Canadian cybersecurity firm, who was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records cited by KrebsOnSecurity; Dubrovsky has not been convicted and prosecutors asked that he remain in custody pending trial. ShinyHunters uses phishing to steal credentials, exfiltrates data from cloud services, and threatens publication unless victims pay, with the FBI attributing more than $70 million in 2026 payments to the group, according to KrebsOnSecurity.
Data Breach
HIGH
Splunk Enterprise Security CVE-2026-76299 and CVE-2026-76302 Rated CVSS 9.9 Critical#
Splunk released a security hardening advisory on October 22 that includes two vulnerabilities, CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization), each assigned a CVSS 3.1 score of 9.9 by Splunk. CISA's vulnerability enrichment on NVD records exploitation status as none and technical impact as total as of October 22. All four CVEs in the advisory were listed as awaiting analysis by NVD at time of publication.
Vulnerability
HIGH
ShinyHunters Investigation: Federal Investigators Suspect Ransomware Negotiation Firm Executives Operated Extortion Site#
KrebsOnSecurity reported on October 19 that FBI investigators believe at least one executive at a large U.S.-based consulting firm with more than 1,000 associates played an active role in operating the ShinyHunters victim extortion website Shinywire, which was active from approximately May 3 through October 16, 2026, and listed entries for nearly 100 organizations. KrebsOnSecurity also reported that investigators suspect executives at a second ransomware negotiation firm maintained unusually close relations with the group. No charges have been filed against the U.S.-based executives and they have not been convicted of any offense. The KrebsOnSecurity report further stated that the FBI attributes more than 70 million dollars in 2026 payments to ShinyHunters.
Other
HIGH
CVE-2026-21589 - Atlassian Multi-Product Pre-Authentication File Read Added to CISA KEV#
CVE-2026-21589 is an unauthenticated arbitrary file read vulnerability affecting eight self-managed Atlassian products, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. CISA added it to the Known Exploited Vulnerabilities catalog on October 15, marking exploitation as active per the CISA KEV feed, with a federal remediation due date of October 18. Organizations running end-of-life versions of any affected product may also be affected per Atlassian's advisory.
Vulnerability
MEDIUM
State Bank of India Customer PII Data Leak#
Dark Reading reported on October 23 that an anonymous hacker leaked sensitive customer records from the State Bank of India, with the organization disclosing in a notice to India's National Stock Exchange that 3,897 customer records had been exposed. Dark Reading noted that even relatively small data breaches in India carry elevated risk due to a sophisticated underground market for trading personally identifiable information. The incident underscores ongoing targeting of large financial institutions for customer data.
Data Breach
October 22, 2026
Automated summary. Two critical PHP remote code execution vulnerabilities, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), dominated the threat landscape over the past 24 to 48 hours. Patches were released on October 21 after CVE identifiers leaked online a day early, and SecurityWeek reports that Amazon observed the first exploitation attempt on October 17, before the embargo lifted, with mass scanning activity beginning shortly after patches were published. CISA issued an alert calling the flaws critical and urging immediate patching; the bugs carry a CVSS 3.1 score of 9.8 per NVD and affect every PHP installation that processes web requests, covering PHP-FPM, Apache module deployments, php-cgi, FrankenPHP, and LiteSpeed. Vendors including technology and security firms are actively checking their products for exposure and shipping detections, while PHP released fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Several other high-impact developments broke or progressed this week. CISA, the FBI, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom published joint advisory AA26-293A on October 20 warning that the SafePay ransomware group has hit at least 600 victims across multiple critical infrastructure sectors since August 2024, using stolen or guessed credentials, VPN access, and unpatched edge device vulnerabilities. Separately, Mandiant and Google Threat Intelligence Group attributed the exploitation of a critical BeyondTrust Remote Support zero-day, CVE-2026-102764 (CVSS 4.0 score of 9.3), to a China-linked group they call Armory Castle, which conducted espionage operations against privileged access management appliances for approximately seven weeks before disclosure on October 15 or 16. CISA added that vulnerability to its Known Exploited Vulnerabilities catalog on October 16.
On the supply chain front, OVHcloud disclosed on October 21 that attackers replaced legitimate release binaries in its open-source CLI tool on October 19 via a hijacked developer GitHub account, with the malicious builds available for approximately 94 minutes and downloaded roughly 250 times. Researchers at OpenSourceMalware linked the compromised account to threat actors associated with GlassWorm, though OVHcloud's own advisory does not attribute the attack to a named group and researchers note the attribution is based on inference. A joint StopRansomware advisory, a PHP critical patch emergency, an active Chinese APT campaign against a widely deployed privileged access tool, and a supply chain compromise of a major European cloud provider's CLI together represent a notably broad and operationally significant set of concurrent threats for enterprise defenders to address.
CRITICAL
SafePay Ransomware: CISA-FBI Joint Advisory AA26-293A - 600+ Critical Infrastructure Victims#
A joint advisory from the FBI, CISA, US Secret Service, UK National Crime Agency, and German law enforcement (AA26-293A, October 20, 2026) warns that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024. SafePay operators gain initial access through stolen or guessed credentials, phishing, and exploitation of vulnerabilities in VPNs and edge devices, including CVE-2024-40711 and CVE-2024-40766 listed in the advisory. Before encrypting systems, the group factory-resets network-attached storage, deletes shadow copies, and terminates backup agent processes to eliminate recovery options.
Ransomware
CRITICAL
SafePay Ransomware: CISA-FBI Joint Advisory AA26-293A, 600 Victims Across Critical Infrastructure#
CISA, the FBI, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom published joint advisory AA26-293A on October 20, warning that SafePay ransomware has hit at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. The advisory states SafePay actors gain access via stolen or guessed credentials, VPN exploitation, and phishing, and that the operators factory-reset network-attached storage devices, deleted shadow copies, and terminated backup agent processes before encrypting, according to additional reporting. SafePay operates without affiliates and does not use the ransomware-as-a-service model.
Ransomware
HIGH
ShinyHunters Extortion Network - Suspected Ransomware Negotiator Ties and Ongoing FBI Investigation#
KrebsOnSecurity reported on October 19, 2026 that U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who allegedly maintained unusually close relations with the extortion group. According to KrebsOnSecurity, sources close to the investigation say one executive in the United States allegedly helped ShinyHunters operate Shinywire, a website active from approximately May 3, 2026 until October 16 that listed nearly 100 hacked organizations and pressured victims to pay ransom. KrebsOnSecurity withheld the executive's identity and company name because no charges had been filed at time of publication. The investigation follows the arrest of Canadian cybersecurity executive Edward Dubrovsky, whose charges and status are as described in public court records; he has not been convicted.
Other
HIGH
OVHcloud CLI Supply Chain Compromise Linked to GlassWorm Threat Actors#
On October 19, attackers using a hijacked OVHcloud developer GitHub account replaced release binaries for OVHcloud CLI versions 0.11.0 through 0.15.0 with malicious builds designed to steal secrets from disk; the tampered releases were available for approximately 94 minutes and downloaded roughly 250 times, according to OVHcloud's postmortem. Researchers at OpenSourceMalware linked the compromised account to threat actors associated with GlassWorm based on a Solana wallet found in earlier force-pushed repositories, though OVHcloud's own advisory does not attribute the attack to a named group and researchers note the link is an inference. The malicious builds affected macOS, Linux, and Windows targets while source code and Docker images remained unaffected.
Malware
HIGH
ShinyHunters Investigation: Feds Suspect Ransomware Negotiators Ran Extortion Site#
KrebsOnSecurity reported on October 19 that U.S. federal investigators have identified executives at two ransomware negotiation firms who, according to sources close to the investigation, maintained unusually close relations with the ShinyHunters hacking group and that one U.S.-based executive allegedly helped operate a website used to pressure victims into paying ransoms. On October 9, KrebsOnSecurity reported that the FBI arrested Edward Dubrovsky, identified as a 54-year-old Canadian cybersecurity executive, who was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion according to court records; Dubrovsky has not been convicted. KrebsOnSecurity reported the FBI attributes more than $70 million in 2026 payments to ShinyHunters.
Other
HIGH
Oracle October 2026 Critical Patch Update: 1,209 CVEs Including 95 Critical#
Oracle released its October 2026 Critical Patch Update on October 22, delivering 1,295 security patches addressing 1,209 unique CVEs, including 95 critical-severity flaws across dozens of products, according to SecurityWeek citing a Tenable analysis. Fusion Middleware received the most patches in this cycle. Among the notable individual CVEs in this cycle is CVE-2026-91403, an authentication bypass in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition rated CVSS 9.1, publicly disclosed on October 21.
Vulnerability
October 21, 2026
Automated summary. The past 24 to 48 hours have produced an unusually dense cluster of high-severity developments across vulnerability management, ransomware, and supply-chain security. Most urgently, the PHP security team released emergency patches today (October 21) for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively branded PHP2Shell, each rated 9.2 under CVSS v4.0. The disclosure timeline was compressed after details leaked ahead of the scheduled release date, and researchers at watchTowr confirmed they had reproduced at least one of the flaws. Because PHP underlies a large share of the world's web infrastructure, organizations running any supported PHP 8.x branch below the fixed releases, or any version of PHP 5 or 7 for which no patch exists, should treat remediation as an emergency priority.
Also demanding immediate attention is the ConnectWise Cloud Backup supply-chain incident, which remained active and unresolved as of this morning. Attackers used a compromised OAuth application credential to authenticate silently into at least 173 Microsoft 365 tenants managed by downstream MSP customers, bypassing multi-factor authentication entirely because the access was application-level rather than user-level. ConnectWise suspended the Cloud Backup service on October 17 and has not provided a restoration timeline. In at least some affected tenants, attackers escalated to Global Administrator and planted persistent credentials valid through 2028. Separately, CISA and the FBI jointly published advisory AA26-293A on October 20 warning that the SafePay ransomware group has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024.
The broader week-over-week picture reflects a threat landscape in which privileged-access and identity infrastructure have become primary targets. The BeyondTrust Remote Support zero-day (CVE-2026-102764, CVSS 9.3) was exploited by a suspected China-nexus group for seven weeks before disclosure, giving attackers access to stored credentials across every system the appliance managed. Microsoft's October Patch Tuesday addressed 1,411 vulnerabilities including one actively exploited Windows Shell bypass. CISA added six additional vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, including multiple Plex Media Server flaws and a Siemens Software Center DLL side-loading flaw being weaponized in ClickFix social-engineering campaigns. Defenders should prioritize patch verification for all items on the CISA KEV catalog, audit MSP supply-chain application permissions in Microsoft Entra, and test PHP version currency across web-hosting environments before the end of the business day.
CRITICAL
PHP Core RCE: CVE-2026-109618 and CVE-2026-109619 (php2shell)#
Two critical unauthenticated remote code execution vulnerabilities in the PHP language runtime core, tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 by the PHP security team, were pre-announced ahead of an emergency patch release scheduled for October 21, 2026 at 14:00 UTC after details leaked publicly. Security researchers at watchTowr confirmed the vulnerabilities are real and indicate that both are unauthenticated, meaning an attacker who can reach a PHP application over the network could execute code without any login. No in-the-wild exploitation had been confirmed as of October 20, but a proof-of-concept dubbed 'PHP2Shell' has reportedly leaked, and PHP 5 and PHP 7 installations are expected to receive no official patch as those branches have reached end-of-life.
Vulnerability
CRITICAL
ConnectWise Cloud Backup Supply-Chain Attack Compromises 173 Microsoft 365 Tenants via Stolen OAuth Credential#
On October 15, 2026, attackers used a compromised OAuth application credential belonging to ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to authenticate into at least 173 Microsoft 365 tenants managed by downstream MSP customers, according to security firm Huntress. The attack bypassed MFA because access was application-level rather than user-level, and attackers inherited broad Graph API permissions including full mailbox, OneDrive, SharePoint, Teams, and directory access. In at least one monitored instance, attackers escalated to Global Administrator and created new persistent credentials valid through 2028; ConnectWise disabled the affected application identities and suspended the Cloud Backup service on October 17, and the restoration timeline remained unconfirmed as of October 20.
Data Breach
HIGH
CISA #StopRansomware Advisory: SafePay Ransomware (AA26-293A)#
CISA, the FBI, and the U.S. Secret Service published joint advisory AA26-293A on October 20, 2026, detailing the tactics, techniques, and procedures of the SafePay ransomware group, which the FBI describes as among the most active ransomware groups with more than 600 victims since 2024. SafePay actors gain initial access through credential theft, brute-force attacks, and exploitation of VPN access -- specifically using Mullvad VPN IP addresses -- then use living-off-the-land binaries such as PsExec and Windows Remote Management to move laterally, before encrypting files and employing a double extortion model that includes threatening to publish stolen data and, in some cases, direct phone contact with victims. The group also uses UAC bypass privilege escalation techniques and has been observed deleting shadow copies and resetting backup devices to disrupt recovery.
Ransomware
HIGH
A chain of four Plex Media Server vulnerabilities collectively dubbed Plex2Shell, involving server-side request forgery and path control weaknesses, began being actively exploited in the wild on October 17, 2026 -- one day after the researcher who discovered them published a write-up and proof-of-concept code. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on October 20, 2026, noting that observed attacks have delivered cryptocurrency miners and proxy software to compromised servers. Plex had released patches for versions 1.43.2 and earlier on September 1, 2026, meaning organizations that had not yet applied available updates were exposed.
Vulnerability
HIGH
ShinyHunters Ransomware Negotiation Conflict-of-Interest Investigation#
KrebsOnSecurity reported on October 19, 2026 that federal investigators suspect an executive at a large U.S.-based consulting firm with more than 1,000 associates may have played an active role in operating Shinywire, the now-defunct ShinyHunters victim extortion website that was active from approximately May 3 through October 16, 2026 and listed entries for nearly 100 hacked organizations. Investigators reportedly obtained leads after Dutch police arrested ShinyHunters suspect Pepijn van der Stap in September 2026 and accessed Signal conversations while he was logged in; no charges have been filed against the unnamed U.S. executive and no conviction has been entered. Separately, KrebsOnSecurity reported on October 9 that a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky was arrested in connection with the ShinyHunters investigation; according to KrebsOnSecurity, he faces charges involving threats to disclose stolen information and interference with interstate commerce through extortion, and has not been convicted.
Other
HIGH
CISA / FBI / Secret Service Joint Advisory AA26-293A: SafePay Ransomware Has Targeted 600+ Organizations#
CISA, the FBI, and the U.S. Secret Service issued joint advisory AA26-293A on October 20, 2026 under the StopRansomware initiative, warning that the SafePay ransomware group has targeted at least 600 organizations worldwide since August 2024. The advisory details tactics including a UAC bypass privilege-escalation technique that creates an elevated process through a specified Component Object Model object, followed by token impersonation; targeted sectors include critical infrastructure across North America, South America, Europe, and Australia. The authoring agencies recommended disabling command-line and scripting activities and permissions as a primary mitigation to interrupt SafePay's lateral movement and privilege escalation paths.
Ransomware
HIGH
Siemens Software Center CVE-2026-110936 Actively Exploited in Romulus ClickFix DLL Side-Loading Campaign#
Siemens confirmed on October 19, 2026 that CVE-2026-110936, a DLL side-loading vulnerability rated CVSS v4.0 8.4 in Siemens Software Center versions before 4.0.9.8, is being actively exploited in the wild. Attackers associated with the Romulus multi-platform ClickFix campaign pair a genuine, validly signed copy of Siemens Software Center with attacker-controlled malicious DLL files distributed outside official channels, relying on the program's trusted signature to evade detection. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on October 20; Siemens stated its own systems, products, and official update channels were not breached, and noted version 4.0.9.8 resolves the issue and is delivered automatically on next launch.
Malware
HIGH
ShinyHunters Extortion Investigation: Federal Investigators Suspect Ransomware Negotiators Aided Threat Group via Shinywire Site#
U.S. federal investigators examining the ShinyHunters hacking group have identified executives at two ransomware negotiation firms they believe maintained unusually close relations with the group, according to KrebsOnSecurity reporting published October 19, 2026. Investigators reportedly suspect at least one executive at a large U.S.-based consulting firm with more than 1,000 associates helped operate the now-defunct Shinywire victim-extortion website, which was active from approximately May 3 through October 16, 2026 and listed entries for nearly 100 alleged victim organizations. KrebsOnSecurity has not named the company or the suspected executive because no charges have been filed against them; separately, Canadian cybersecurity executive Edward Dubrovsky was arrested on October 9 in connection with the ShinyHunters investigation, and has not been convicted of any offense.
Other
October 20, 2026
Automated summary. The week of October 13-20, 2026 produced an unusually heavy operational burden for security teams, driven by multiple actively exploited zero-days across widely deployed enterprise infrastructure. Microsoft's October Patch Tuesday addressed over 1,400 vulnerabilities, including a Windows Shell security feature bypass (CVE-2026-96951) confirmed as exploited in the wild and a publicly disclosed Windows Defender Application Control bypass (CVE-2026-108398). Simultaneously, critical flaws in Ivanti Connect Secure VPN appliances, Palo Alto Networks PAN-OS firewalls, and BeyondTrust Remote Support were all added to the CISA Known Exploited Vulnerabilities catalog, with confirmed active exploitation observed in at least two of the three cases before patches were available. Network defenders face compounding patch debt across perimeter devices that are prime targets for both nation-state and financially motivated actors.
The ShinyHunters extortion group continued to dominate criminal threat intelligence headlines. KrebsOnSecurity reported on October 19 that FBI investigators now suspect executives at two ransomware negotiation firms maintained unusually close relationships with the group, with at least one allegedly helping operate the group's victim-pressure site, Shinywire. This development raises significant trust concerns about third-party incident response vendors. Separately, Citizen Lab's AdFection investigation, published October 15, provided the first publicly confirmed technical evidence that zero-click mercenary spyware can be delivered to targeted devices simply by serving a normal-looking online advertisement, with no user interaction required. The technique was linked to Candiru spyware and affected devices at Al Jazeera.
On the compliance and policy front, the U.S. Senate passed the Health Care Cybersecurity and Resiliency Act of 2026, which would extend minimum federal cybersecurity requirements to private healthcare entities in the wake of the Change Healthcare breach. CISA and its international partners also issued a joint advisory warning that Integrity Technology Group, a China-based cybersecurity company, is enabling threat actors to target critical infrastructure sectors globally using botnets, VPN infrastructure, and living-off-the-land techniques. Organizations in energy, transportation, and public administration sectors should prioritize review of this advisory alongside their perimeter patching obligations.
CRITICAL
ConnectWise Cloud Backup Supply-Chain Attack Compromises Microsoft 365 Tenants#
On October 15, 2026, attackers used a compromised credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph access tokens and sign into customer Microsoft 365 tenants without triggering multi-factor authentication. Microsoft publicly described this as an active supply-chain attack, noting the attacker abused highly privileged permissions previously granted by customers, including Directory.ReadWrite.All, and then attempted to add backdoor credentials to service principals inside victim tenants. Huntress reported more than 300 successful sign-ins from the attacker's IP address as of October 19; ConnectWise suspended the Cloud Backup, SaaS Security, and Cloud Management services on October 17 and disabled seven associated application identities, though credentials already planted in individual tenants require manual removal.
Vulnerability
HIGH
ShinyHunters Investigation: Ransomware Negotiators Suspected of Operating Extortion Site#
KrebsOnSecurity reported on October 19, 2026, that federal investigators have identified executives at two ransomware negotiation firms who are suspected of maintaining unusually close ties to the ShinyHunters hacking group. According to two sources close to the investigation cited by KrebsOnSecurity, one executive at a U.S.-based consulting firm with more than 1,000 associates is suspected of helping operate shinywire.com, a website used to pressure ShinyHunters victims into paying ransoms; the site listed entries for nearly 100 organizations and went offline on October 16. KrebsOnSecurity reported that the company and individual have not been charged with a crime as of publication, and separately reported on October 9 that a Canadian executive named Edward Dubrovsky was arrested in connection with the ShinyHunters investigation; Dubrovsky faces charges whose status was not resolved at the time of reporting. Charges are allegations; the source reports no conviction.
Ransomware
HIGH
CISA and Partners Warn of China-Linked Integrity Technology Group Enabling Critical Infrastructure Attacks#
On October 8, 2026, CISA, the FBI, NSA, and international partners issued joint advisory AA26-281A warning that Integrity Technology Group, a China-based cybersecurity company, is enabling threat actors to target multiple critical infrastructure sectors worldwide using large-scale botnets, virtual private network infrastructure, and living-off-the-land techniques. The advisory states that Chinese government-affiliated actors are positioning themselves within critical infrastructure networks including operational technology systems with the aim of disrupting critical functions at a future time of their choosing. CISA, the FBI, and NSA urged all organizations, especially those in critical infrastructure, to review the advisory, hunt for signs of compromise, and implement recommended mitigations.
APT
HIGH
AdFection: Zero-Click Mercenary Spyware Delivered via Targeted Online Ads (Citizen Lab)#
Citizen Lab published a report on October 15, 2026, documenting what it describes as the first publicly confirmed case of zero-click mercenary spyware delivered through ordinary targeted online advertising, requiring no click, download, or user interaction. Researchers named the technique AdFection and linked it to Israeli advertising company Discover-Tech, whose Controlium platform allegedly enabled spyware vendors to profile and de-anonymize internet users before delivering malicious code alongside normal ad content. The investigation confirmed that at least 45 devices at Al Jazeera were targeted using Candiru spyware via this pipeline. Google terminated Discover-Tech's access to its ad exchange platforms in early October 2026.
Malware
HIGH
ShinyHunters Ransomware Negotiator Infiltration - FBI Suspects Industry Insiders Operated Extortion Site#
KrebsOnSecurity reported on October 19, 2026, that FBI investigators believe executives at two ransomware negotiation firms maintained unusually close ties to the ShinyHunters extortion group, with at least one executive at a U.S.-based consulting firm with more than 1,000 associates suspected of actively helping operate the now-defunct Shinywire victim-pressure website, which was active from approximately May through October 16, 2026, and listed entries for nearly 100 organizations. The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 9, 2026, in connection with the ShinyHunters investigation; he has not been convicted. Investigators reportedly gained leads after Dutch police arrested ShinyHunters suspect Pepijn van der Stap in September 2026 and accessed his Signal messages while he was logged in.
Ransomware
HIGH
CISA / FBI / NSA Joint Advisory: Integrity Technology Group Enabling China-Linked Attacks on Critical Infrastructure#
CISA, the FBI, NSA, and international partners issued a joint advisory on October 8, 2026, warning that Integrity Technology Group, a China-based cybersecurity company, is enabling threat actors to target critical infrastructure sectors worldwide using large-scale botnets, VPN infrastructure, and living-off-the-land techniques. The advisory states that these actors are targeting edge devices that are not closely monitored by victim organizations in order to maintain long-term, stealthy access, and that their goal includes positioning within operational technology systems with the aim of disrupting critical functions at a future time of their choosing. The advisory provides indicators of compromise and recommended mitigations for network defenders.
APT
MEDIUM
Backdoored Open-Weight AI Models Pose Supply-Chain Risk in Enterprise Agent Stacks#
Research highlighted by Bruce Schneier on Schneier on Security on October 16, 2026, documented how open-weight AI models distributed via platforms such as Hugging Face can carry hidden backdoors that pass standard evaluations and behave normally until a trigger phrase is encountered. ProjectDiscovery demonstrated the attack by poisoning a model based on an open base, a public dataset, and a rented GPU; when run through OpenAI's Codex CLI, the model exfiltrated project credentials upon receiving the trigger. Schneier noted that AI systems are subject to the same supply-chain attacks as ordinary software, and that model opacity makes inspection especially difficult; researchers also showed that the remote payload URL embedded in the model can be changed months after deployment without retraining.
Malware
October 19, 2026
Automated summary. The week of October 13-19, 2026 has been defined by actively exploited vulnerabilities in widely deployed remote-access and privileged-access management infrastructure, a large-scale supply chain compromise affecting managed service providers, and fresh intelligence linking state-sponsored actors to stealthy, memory-resident implants on enterprise firewalls. The most urgent development today is the ConnectWise Cloud Backup supply chain attack, in which attackers used a compromised application credential to gain unauthorized access to at least 173 Microsoft 365 customer tenants; ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services on October 17 while the investigation continues. Separately, CISA added CVE-2026-102764 in BeyondTrust Remote Support to its Known Exploited Vulnerabilities catalog on October 16, with Google Threat Intelligence Group and Mandiant attributing exploitation to ARMORY CASTLE, a suspected China-linked espionage group that began exploiting the CVSS 9.3 flaw as a zero-day in late August.
Microsoft's October 2026 Patch Tuesday, released October 13, addressed over 1,400 vulnerabilities across Windows, Office, SharePoint, and developer tools, including one actively exploited zero-day (CVE-2026-96951, a Windows Shell security feature bypass) and two publicly disclosed zero-days. The volume far exceeds prior monthly totals and places exceptional strain on enterprise patch operations. Palo Alto Networks Unit 42 simultaneously published details of a newly discovered memory-resident FortiGate implant named PEERSTITCH, deployed by threat cluster CL-STA-0954 (also tracked as UNC5820) against a telecommunications managed service provider; CISA added the enabling Fortinet path traversal flaw, CVE-2025-61624, to its KEV catalog on October 16 and is urging immediate remediation.
On the criminal and law enforcement front, KrebsOnSecurity reported on October 19 that U.S. federal investigators suspect at least one executive at a ransomware negotiation firm helped ShinyHunters operate their victim extortion website, raising serious concerns about conflicts of interest in the incident response industry. The Rank Math PRO WordPress plugin was confirmed compromised in a supply chain attack affecting version 3.0.123 packages distributed between October 15 and 16, with a CVE score of 9.8 (CVSS) assigned to the associated vulnerability. Across the board, the pattern this week reflects attackers systematically targeting trusted tools -- backup software, remote support appliances, firewall management infrastructure, and WordPress plugins -- as force-multiplying entry points into downstream customer environments.
CRITICAL
ConnectWise Cloud Backup Supply Chain Attack -- 173 Microsoft 365 Tenants Compromised#
Attackers used a compromised application credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to at least 173 Microsoft 365 customer tenants beginning October 15, 2026, according to Huntress, which first identified the incident. Because the application had been granted broad permissions including access to Exchange Online, OneDrive, SharePoint, Teams, and directory data, an attacker holding its tokens inherited the same access in every tenant where the app was installed, bypassing per-user MFA entirely. ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services on October 17 by disabling seven application identities and revoking associated certificates, though the company states investigation and remediation are ongoing.
Data Breach
CRITICAL
CVE-2025-61624 -- Fortinet Path Traversal Exploited to Deploy PEERSTITCH Memory-Resident Firewall Implant#
Palo Alto Networks Unit 42 published details of a previously unknown memory-resident ARM64 implant named PEERSTITCH, deployed against a telecommunications managed service provider by threat cluster CL-STA-0954 (also tracked as UNC5820) through exploitation of CVE-2025-61624, a path traversal flaw in the FortiOS CLI auto-script engine, chained with an earlier FortiManager vulnerability (CVE-2024-47575). PEERSTITCH patches running FortiGate process memory, leaves no persistent binary on disk, opens no listening ports, and communicates covertly through legitimate process traffic, making conventional detection very difficult. The attack resulted in exfiltration of a configuration archive containing details on FortiManager and more than 500 managed FortiGate firewalls, including credentials and cryptographic material; CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026.
APT
CRITICAL
Rank Math PRO WordPress Plugin Supply Chain Attack (CVE-2026-111862, CVSS 9.8)#
Attackers injected malware into version 3.0.123 of the Rank Math PRO WordPress SEO plugin, which was distributed between October 15 and October 16, 2026, according to SecurityWeek. A CVE, CVE-2026-111862, was assigned with a CVSS score of 9.8. Any WordPress site that downloaded or auto-updated the plugin during that window may have received a malicious build, and site operators should verify their installed version and audit for signs of compromise.
Malware
HIGH
ShinyHunters Extortion Network -- Feds Suspect Ransomware Negotiator Operated Victim Pressure Site#
KrebsOnSecurity reported on October 19, 2026 that U.S. federal investigators believe at least one executive at a large U.S.-based consulting firm with more than 1,000 associates helped operate the now-defunct ShinyHunters victim extortion website shinywire[.]com, which was active from approximately May 3 through October 1, 2026. Sources told KrebsOnSecurity that the suspected executive and others at ransomware negotiation firms had knowledge of new ShinyHunters victims before those victims were themselves aware of their breaches. The company and suspected individual have not been named because they have not been charged, and charges are only allegations; the FBI arrested a separate individual, the co-founder of a Canadian cybersecurity firm identified as Edward Dubrovsky, in connection with the ShinyHunters investigation on October 9, 2026, according to KrebsOnSecurity. Charges are allegations; the source reports no conviction.
Ransomware
HIGH
Candiru Spyware AdFection Campaign -- Zero-Click Delivery via Targeted Online Advertisements#
Citizen Lab researchers uncovered an operation dubbed AdFection in which Candiru spyware was delivered to devices via targeted advertisements purchased by Israeli company Discover-Tech, according to SecurityWeek and The Record, with the research published October 17, 2026. The campaign involved zero-click attacks that de-anonymized, fingerprinted, and infected users and also enabled threat actors to track millions of devices without any user interaction. Citizen Lab reported that devices at international news network Al Jazeera were infected as part of the operation.
APT
October 18, 2026
Automated summary. The past week has been dominated by a convergence of actively exploited zero-days across critical network-edge platforms. BeyondTrust Remote Support, Ivanti Connect Secure, Palo Alto Networks PAN-OS, and Cisco Secure Email Gateway all disclosed vulnerabilities that were being weaponized in the wild, with CISA adding multiple entries to its Known Exploited Vulnerabilities catalog in rapid succession. The most strategically significant development is the attribution, by Google Threat Intelligence Group and Mandiant, of the BeyondTrust zero-day (CVE-2026-102764, CVSS 9.3) to a China-linked espionage group tracked as Armory Castle, which had been operating undetected since late August. The Ivanti Connect Secure exploitation chain is particularly alarming because one of the three vulnerabilities chained together still has no patch, the attacker left no persistent malware or webshell on disk, and Ivanti's own Integrity Checker Tool cannot detect the compromise.
Microsoft's October 2026 Patch Tuesday addressed more than 1,400 vulnerabilities across Windows and other products, including one actively exploited zero-day (CVE-2026-96951, a Windows Shell security feature bypass) and two publicly disclosed zero-days. The scale of the release, which according to BleepingComputer totaled 1,411 CVEs on the day of release, underscores the growing burden on security and IT operations teams to triage and prioritize patching at a pace that strains most organizations. A joint advisory from CISA, FBI, NSA, and international partners (AA26-281A) added to the urgency by formally naming Integrity Technology Group, a China-based company, as an enabler of threat actors conducting sustained data theft against critical infrastructure in North America, Southeast Asia, and Africa.
Beyond vulnerabilities, Citizen Lab published findings this week confirming the first publicly documented case of mercenary spyware delivered via zero-click targeted advertising, a technique researchers have named AdFection. The report links Candiru spyware infections at Al Jazeera Media Network to an Israeli advertising intermediary, Discover-Tech, whose ad platform was used to silently deploy spyware on at least 45 devices in 2024 and 2025 without any user interaction. This development has broad implications for enterprises and media organizations, as traditional endpoint defenses offer little protection against spyware delivered through the legitimate advertising supply chain.
CRITICAL
ConnectWise Cloud Backup Supply Chain Attack - Microsoft 365 Tenant Compromise#
Attackers compromised a credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) and used it to authenticate into customer Microsoft 365 tenants as a trusted service principal, bypassing MFA. Huntress confirmed unauthorized sign-ins across at least 162 tenants in its environment, and other researchers reported the total reaching 173 tenants by October 17. ConnectWise suspended the Cloud Backup service while investigating; Microsoft confirmed the activity as an active supply chain attack.
Data Breach
CRITICAL
CVE-2026-103849 (BlockStrap) - Maximum-Severity RCE in Adobe Commerce and Magento Open Source#
Tracked as CVE-2026-103849 and rated CVSS 10.0 (CVSS v3.1), BlockStrap is a template injection vulnerability in the email template engine of Adobe Commerce and Magento Open Source that allows unauthenticated attackers to execute arbitrary PHP code on store servers with no user interaction required. Adobe addressed the flaw in security bulletin APSB26-153 on October 13, 2026. E-commerce security firm Sansec reproduced four code-execution paths within 24 hours and warned that exploitation is expected soon, citing a similar prior flaw that went from disclosure to mass exploitation in three days.
Vulnerability
CRITICAL
CVE-2026-104935 - Ivanti Connect Secure Zero-Day Chain Exploited in the Wild#
A threat actor Volexity tracks as UTA0576 chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances beginning at least October 3, 2026, achieving unauthenticated root-level code execution on fully patched devices running version 22.8R2.4. CVE-2026-104935, rated 8.6 under CVSS v3.0, covers the authentication bypass and remote code execution steps; Ivanti patched those on October 13 but a privilege escalation flaw used in the same chain remains unpatched. Volexity noted that the attack executes in memory and evades Ivanti's own Integrity Checker Tool, and CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13 with an emergency remediation deadline.
Vulnerability
CRITICAL
CVE-2026-102764 - BeyondTrust Remote Support Zero-Day Exploited by Suspected Chinese State-Backed Group#
A critical vulnerability in BeyondTrust Remote Support appliances, tracked as CVE-2026-102764 and scored 9.3 under CVSS (as reported by Dark Reading), stems from an internal messaging component that did not properly validate the origin of incoming messages. The Record reported that BeyondTrust, Mandiant, and Google Threat Intelligence Group confirmed active exploitation and identified the group behind the attacks as one they call Armory Castle or UNC5221, which used custom malware they call Sawfly and Bareclaw. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026.
APT
CRITICAL
Palo Alto Networks PAN-OS RCE Zero-Day CVE-2026-0322 Exploited Against Firewalls#
Palo Alto Networks disclosed and patched a high-severity remote code execution zero-day tracked as CVE-2026-0322 in PAN-OS, which has been exploited in attacks targeting customer firewalls. The company noted it is aware of limited exploitation and has published indicators of compromise. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and required federal civilian agencies to mitigate the vulnerability by October 17, 2026, according to BleepingComputer.
Vulnerability
CRITICAL
Cisco Secure Email Gateway CVE-2026-76519 Actively Exploited for Arbitrary File Write and Root Command Execution#
Cisco disclosed active exploitation of CVE-2026-76519 (CVSS score of 9.8, per SecurityWeek) in its Secure Email Gateway, a flaw in the Advanced Malware Protection feature that allows remote, unauthenticated attackers to write arbitrary files to the operating system and execute commands with root privileges. Cisco stated it became aware of active exploitation in October 2026, has directly contacted affected cloud customers, and has deployed mitigations within Cisco-managed environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 14, 2026.
Vulnerability
HIGH
Microsoft October 2026 Patch Tuesday - CVE-2026-96951 Windows Shell Zero-Day Actively Exploited#
Microsoft's October 2026 Patch Tuesday addressed 1,411 vulnerabilities, including CVE-2026-96951, a security feature bypass in the Windows Shell that is confirmed as actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog. The update also includes 70 Critical-rated flaws, 57 of which are remote code execution issues spanning Windows, Office, SharePoint Server, and developer tools. BleepingComputer noted that Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of support on October 13, removing future security update eligibility for those versions.
Vulnerability
HIGH
Integrity Technology Group (China-Linked) Advisory - Critical Infrastructure Targeting via Botnets and Edge Devices#
On October 8, 2026, CISA, FBI, NSA, and international partners issued a joint advisory warning that Integrity Technology Group, a China-based cybersecurity company, is enabling threat actors to target multiple critical infrastructure sectors worldwide using large-scale botnets, virtual private network infrastructure, and living-off-the-land techniques. The advisory states that these actors target edge devices that are not closely monitored and are positioning themselves within operational technology systems with the aim of disrupting critical functions at a future time of their choosing. Organizations are urged to hunt for indicators of compromise and patch known exploited CVEs listed in the advisory.
APT
HIGH
French Supermarket Refrigeration Cyberattack - ICS/OT Physical Impact#
A cyberattack disrupted refrigeration control systems at approximately 700 French supermarkets, causing overheating, food spoilage, and fires according to SecurityWeek and Schneier on Security. SecurityWeek reported that France's national cybersecurity agency ANSSI confirmed that equipment from Copeland and its Dixell brand was also affected, in addition to other controllers. No group has claimed responsibility for the attack as of October 15, 2026.
Other
HIGH
Candiru AdFection Zero-Click Spyware Delivered via Targeted Online Ads to Al Jazeera Devices#
Citizen Lab and Confiant published findings on October 15, 2026, documenting what researchers describe as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted online advertising, a technique they call AdFection. Candiru spyware was delivered to at least 45 devices at Al Jazeera Media Network in 2024 and 2025 by embedding attack code in ads purchased through Israeli advertising intermediary Discover-Tech; the spyware installed when a targeted device rendered the ad, with no click or user action required. Citizen Lab linked the attacks to Candiru with high confidence based on network logs and code analysis, and did not attribute the operation to a specific government customer.
Malware
HIGH
CISA-FBI-NSA Joint Advisory AA26-281A: Integrity Technology Group Enables Chinese Government-Linked Threat Actors Against Critical Infrastructure#
On October 8, 2026, CISA, FBI, NSA, and partners from the UK, Australia, Canada, Japan, New Zealand, and Spain published joint advisory AA26-281A, identifying Integrity Technology Group, a China-based company, as an enabler of threat actors conducting data theft operations against critical infrastructure worldwide. The advisory states that these actors combine large-scale botnets, automated scanning using more than 1,300 penetration-testing scripts, XSS-based credential harvesting, and password spraying against Microsoft Exchange to steal email and credentials, then install SoftEther VPN clients disguised as Windows binaries to maintain persistent access. Target sectors cited in the advisory include government, critical manufacturing, healthcare, and information technology in North America, Southeast Asia, and Africa, with activity indicators in the advisory stretching back to 2016 per published reporting.
APT