Cisco has released security updates to fix a high-severity zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers are exploiting the flaw to remotely crash vulnerable firewall devices.
Tracked as CVE-2026-76418, the vulnerability can trigger a denial-of-service (DoS) condition. The vulnerability exists due to a logic error when secondary authentication is configured on a tunnel group. A remote attacker can send specially crafted request when connecting to the SSL remote access VPN and perform a denial of service attack.
Palo Alto Networks has warned of active exploitation targeting its internet-exposed management interfaces using the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The flaws allow unauthenticated remote code execution on affected PHP systems. Patches were released on October 21, 2026.
Dream researchers reported that suspected Chinese hackers have chained the PHP2Shell vulnerabilities with CVE-2026-46300 aka Fragnesia, a Linux kernel privilege escalation flaw, to gain root access to servers across the United States, Japan, Taiwan, and South Korea.
Sophos has observed attempts to exploit the PHP2Shell vulnerabilities to install Potassium, a Mirai-derived variant capable of launching distributed denial-of-service (DDoS) attacks and downloading additional malware.
It’s also worth mentioning that PHP has rebuilt its official Windows packages for versions 8.2 through 8.5 to fix a security flaw in the Brotli compression library that could allow attackers to corrupt memory and potentially run code.
CVE-2026-111497 (aka Node2Shell, HTTPS2Shell, Brocolli2Shell, and the Brotlipocalypse) is a Brotli vulnerability that could allow unauthenticated remote code execution through specially crafted compressed data. It affects multiple applications, libraries, and infrastructure tools using Brotli, including Node.js, Python integrations, Bun, Envoy, and Istio.
The US Cybersecurity and Infrastructure Security Agency (CISA) added a VMware ESX vulnerability (CVE-2026-41709) to its Known Exploited Vulnerabilities (KEV) catalog after it was used by a China-linked threat actor, tracked as Warp Panda, Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo, in attacks targeting the US legal sector. The flaw allows attackers with administrator access to perform certain actions without being recorded in system logs.
Threat actors have started probing for a critical Oracle E-Business Suite (EBS) vulnerability (CVE-2026-101767). The flaw allows attackers to bypass authentication. Oracle released a security patch as part of its October 2026 Critical Patch Update.
Ukraine’s national cyber incident response team (CERT-UA) has warned that threat actors can get unauthorized remote access to Dahua security cameras and video recorders. The agency said that the main attack vector is the P2P cloud access feature, known as Easy4IP. It allows devices to connect to the manufacturer’s cloud service, which can let attackers access them even when they are not directly exposed to the internet. Hackers can find devices by searching for their serial numbers and exploiting weak passwords or security flaws in outdated software.
Check Point researchers discovered a new information-stealing malware called Aokigahara, possibly an earlier version of Kamidere or Stygian. It steals sensitive data from browsers, VPNs, cryptocurrency wallets, password managers, and other applications. It also targets AI tools such as ChatGPT Desktop, Claude, Codex, Cursor, and GitHub Copilot to collect authentication files, session data, and configuration information.
Check Point also spotted a separate malware campaign called Yoba using fake GitHub projects disguised as popular AI desktop applications, such as ChatGPT and Claude. The malware uses legitimate, signed software to load malicious files and avoid security detection. The attackers also use services like Telegram, Tor, and DNS over HTTPS to hide activities. Evidence suggests the attackers may have Russian origins.
A malicious campaign targeting Hugging Face is once again active, spreading fake AI models that install cryptocurrency miners and backdoors. Researchers found 31 malicious repositories across seven accounts, with the most popular model downloaded over 28,000 times. The malware can steal access to infected servers, run hidden mining processes, and give attackers remote control.
Researchers have detailed an attack that uses a malicious markdown file to trick AI coding agents into installing malware and stealing account credentials. The attack exploits the agents’ habit of automatically following instructions in files within their working folders.
Moldova has suffered a major cyberattack on its government information systems, with hackers stealing sensitive personal information belonging to around 750,000 citizens, about one-third of the population. The government shut down 82 public digital services and 30 government networks to prevent further data theft. The stolen data included personal, financial, medical, and social security information. The hackers got access by exploiting vulnerabilities in a logging service left exposed online without authentication.
Crypto hardware wallet maker Keystone said it will destroy 18,835 unsold devices after an attacker stole a security key used to verify that its wallets are genuine. The company said that the stolen key could allow criminals to create fake devices that pass its online authentication check. This means that users who trust a fake device could lose their cryptocurrency. However, the breach did not expose wallet private keys or recovery phrases, the company said.
The US Treasury sanctioned 10 individuals and one entity for helping North Korea operate illegal IT worker schemes that generate money for its weapons programs. Authorities say that Russian nationals Ilya Boykov and Vitold Obertas converted millions of dollars in cryptocurrency, while North Korean nationals Kim Ki Hyok and Kim Hyo Dong managed IT workers in Russia and collected their earnings.
The FBI has seized the domain of Virtualine, a hosting provider accused of supporting cybercrime, money laundering and the distribution of child sexual abuse material. Authorities had seized virtualine[.]net following an international investigation. The service operated under several names, including Secury, Massgod, Spamhouse, Lanedo and Omegatech. Virtualine allegedly advertised hosting services for illegal activities, including phishing, credit card fraud and spam.
Artem Stryzhak, a 36-year-old Ukrainian citizen, has been sentenced to 70 months in prison for participating in ransomware attacks worldwide. As a member of the Nefilim and Hive ransomware groups, he helped hack hospitals, businesses, law firms, and government agencies, causing more than $100 million in losses. Between 2021 and 2023, the attacks affected around 1,500 victims, including hospitals, disrupting healthcare services.
Ahmad Umar Agha, a Syrian hacker, was sentenced to 42 months in prison for carrying out cyberattacks on behalf of the former Bashar al-Assad regime. He targeted around 47 Western media organizations, businesses, NGOs, and government agencies to spread propaganda, gather intelligence, and silence critics of the Syrian government. His actions also contributed to a US stock market crash that temporarily caused $136 billion in losses. His accomplice, Firas Dardar, remains a fugitive.
Spanish National Police have arrested a man in Mérida suspected of hacking the Extremadura Health Service's online portal. The cyberattack exposed the medical records of 18,416 patients, containing more than 334,000 records. The suspect allegedly stole the data to sell it on illegal online forums. Police seized computers and recovered the stolen database during a search of his home.