Threat actors attempted to exploit two critical PHP vulnerabilities four days before information about the flaws was made public. Amazon Threat Intelligence said it observed possible PHP2Shell exploitation attempt on October 17, 2026, four days before the vulnerabilities were publicly disclosed.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code on vulnerable servers without authentication. The vulnerabilities affect PHP web server setups, including PHP-FPM, Apache, and LiteSpeed.
Arista Networks released security updates to fix an actively exploited zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated attackers with basic privileges to gain higher-level access through SQL injection. Hosted VCO deployments on specified versions have already been patched.
Attackers began exploiting four Plex Media Server vulnerabilities just one day after details and proof-of-concept (PoC) code were publicly released on October 16. Known as Plex2Shell, the flaws allow attackers to execute code on exposed servers without logging in, using the same privileges as the Plex service.
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities to maintain long-term access to a telecommunications organization. The intrusion, attributed to UNC5820 (CL-STA-0954), leveraged previously unknown malware called PeerStitch. The attackers initially gained access by exploiting CVE-2024-47575, a critical remote code execution (RCE) vulnerability in FortiManager known as FortiJump. The flaw allowed attackers to compromise vulnerable management systems and was patched in October 2024
Siemens has confirmed that threat actors exploited a vulnerability in its Software Center as part of a malware campaign. The flaw, tracked as CVE-2026-110936, allows an authenticated local attacker to execute malicious code by placing a malicious DLL file in a folder searched by Siemens Software Center. Siemens released a fix in Software Center version 4.0.9.8. According to the vendor, threat actors used a legitimate, digitally signed copy of the software and malicious DLL files to load the code.
Palo Alto Networks has warned that ransomware groups continue to exploit CVE-2026-0257, a security flaw affecting PAN-OS and Prisma Access that allows attackers to establish unauthorized VPN connections. The Qilin (aka Spikey Scorpius) and INC (Tarnished Scorpius) ransomware groups are using the flaw to gain initial access to corporate networks and bypass multi-factor authentication (MFA).
A Russian-speaking threat actor has gained access to an Elasticsearch server and stole 6.8 million documents from Ukraine's state data-exchange platform via Graylog Log4Shell.
French cloud and hosting provider OVHcloud warned that hackers compromised its CLI tool by hijacking a developer’s GitHub account and planting malware designed to steal sensitive information. Versions 0.11.0 to 0.15.0 were affected; version 0.10.0 and the newer 0.16.0 are not impacted. The attack has been linked to the GlassWorm threat group, which targets software developers and access to sensitive systems.
Russian-linked hacking groups targeted a Ukrainian grain logistics company in a destructive cyberattack in July 2025. The attackers gained access through a phishing email containing a malicious attachment. Threat actors installed a backdoor called MatchWok to maintain access to the company’s network. They then deployed a previously undocumented Go-based backdoor called MythicRatatoskr, which allowed them to execute commands remotely, steal files, and capture screenshots. ESET says that the UAC-0099 cyberespionage group got access to the target network and then handed it over to the Sandworm hackers who then conducted a data-wiping attack.
Russia-linked APT28 state-backed group has targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer. The attacks aimed to steal sensitive information related to national security and defense. The attackers used the Hookedge backdoor delivered via malicious Word documents containing macros.
China-linked threat actor, which Microsoft tracks as Storm-0940, used AI-powered penetration testing framework ARTEX to automate cyberattacks against hundreds of organizations worldwide. Some attacks gained privileged access to cloud systems in less than three hours. Microsoft also links Storm-0940 to the recently disclosed ConnectWise supply chain compromise.
Bronze Sandcastle, a previously undocumented China-aligned threat group, has been targeting organizations in Asia and Africa since mid-2025, including the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. According to Sophos, the group uses Sandboxie DLL sideloading, placing legitimate Sandboxie executables alongside a malicious sbiedll.dll file to make a trusted application (SandboxieWUAU.exe) load attacker-controlled code.
Hackers breached major Japanese VPS provider Onamae Desktop Cloud and installed malware on up to 26,739 customer servers. The company said that data stored on affected servers may have been impacted, but there’s no evidence of data leaks or misuse. Payment information, including credit card details, was not affected because it is stored separately.
Hackers compromised more than 10% of Tor’s exit relays in one of the largest security incidents in the network’s history. The attackers infected servers with Ebury Linux malware and changed the settings to intercept SSH connections and expose unencrypted email traffic. The attackers also changed email settings, closing ports used for encrypted email while allowing connections that could carry messages in plain text.
Digital security firm eMudhra has announced that it is exiting its global of issuing SSL/TLS certificates for websites after security researchers found that eight intermediate certificates issued by the company had weak private keys. eMudhra said that the issue was caused by a software error that shortened cryptographic keys, making them easier to recover.
Google Threat Intelligence Group (GTIG) and Mandiant have analyzed a software supply chain attack targeting AOMEI Technology’s update infrastructure between April and July 2026. The attackers, tracked as UNC7017, repeatedly modified update server configurations for short periods of just five to ten minutes, which made the campaign difficult to detect through routine security checks.
LiteLLM version 1.107.0 was compromised in a supply chain attack that delivered a credential stealer and backdoor via PyPI packages and Docker images. The attackers reportedly used stolen GitHub OAuth tokens to publish the malicious version. The affected package was quarantined, malicious Docker images were removed, and the compromised tokens were revoked.
University of British Columbia researchers developed a proof-of-concept attack called ICS-Sniper that targets industrial facilities using cloud-based SCADA systems. By analyzing encrypted VPN traffic, attackers could predict critical communications and block important packets. Tests showed that the technique could be used to delay clean water pumping by 15 minutes or keep a valve open over nine minutes longer than intended.
OpenAI has disclosed several new incidents in which its artificial intelligence models acted against safety rules, including one case where a model used cryptocurrency from another person's wallet without permission.
In two other incidents, AI agents powered by GPT-6.1 Sol and GPT-6 Astra weakened safety monitoring while completing coding tasks. One agent disabled human alerts, while the other removed monitoring tools, hid the change, and lied about it when questioned. Although both incidents showed how AI agents can misinterpret instructions and act against safety requirements, OpenAI did not classify either incident as its highest-priority security issue (Priority Zero, P0).
WhatsApp’s help pages reportedly included hidden instructions telling its AI support chatbot not to recommend contacting a data protection regulator to users who couldn’t delete their accounts. This practice conflicted with WhatsApp’s European privacy policy, which says users can complain to a regulator. In response, WhatsApp told WIRED the instructions appeared because of a bug, which has since been fixed.
Meanwhile, WhatsApp’s parent company Meta was ordered to pay $25 billion in penalties after a New Mexico jury found that it violated the state’s consumer protection law more than 43 million times. The company was accused of misleading users about how it collects and protects their personal data and prevents harmful content. The case is linked to the Cambridge Analytica scandal, in which millions of Facebook users’ data was obtained without their consent.
An Interpol-coordinated cybercrime operation involving 21 countries has led to the arrest 1,462 suspects across Africa, with over $105 million in illicit funds recovered and 10,909 malicious networks disrupted. The operation targeted online scams, ransomware, phishing, cryptocurrency fraud and other cybercrimes.
Nigerian national Chukwuemeka Victor Amachukwu was sentenced in the US to eight years in prison for hacking US tax preparation businesses and stealing personal information from at least 800 customers. The group used the stolen data to file fraudulent tax refunds and loan applications, obtaining millions of dollars. He was also ordered to pay $3.6 million in restitution and forfeit nearly $11 million.
Pakistan’s cybercrime agency arrested Faheem Akram accused of operating a website that sold counterfeit US shipping labels. Prosecutors allege the scheme caused $126 million in losses to the US Postal Service and involved more than 5.1 million fake labels. Akram faces several fraud-related charges, but it remains unclear whether he will be extradited to the United States.