Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

,

Amazon’s Threat Intelligence team detected an attempt to exploit the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) four days before their public disclosure, targeting its MadPot honeypot from an anonymized IP address. These flaws affect PHP versions 7.x and 8.x, allowing unauthenticated remote code execution with virtually no detectable traces, prompting worldwide cybersecurity agencies to urge immediate patching as exploitation attempts by multiple threat actors have since increased significantly.

https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

, ,

Attackers hijacked over 300 Tor exit relays in early October 2026, modifying their exit policies to intercept SSH connections by redirecting them to malicious servers that stole login passwords when users accepted fake host keys. The compromise was linked to the Ebury backdoor, installed via stolen credentials on relay operator servers, enabling persistent access and interception of encrypted SSH traffic tunneled through Tor; the Tor Project identified and removed the malicious relays by October 5. Operators affected are advised to check for signs of compromise, treat any passwords entered during the attack window as stolen, and reinstall systems after removing infected relays.

https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

,

GitLab has released patches for a critical vulnerability (CVE-2026-110264) rated CVSS 10.0 that allows unauthenticated remote code execution on self-managed servers across all versions since 7.0 (2014). The flaw stems from an integer overflow in GitLab’s patched version of the Ruby Onigmo regular-expression compiler, and while no exploitation has been reported so far, immediate updates are necessary as no workaround exists and multiple affected versions require upgrading.

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

,

PHP has released emergency patches for two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affecting nearly all versions from PHP 5.4 onward. These flaws, rated 9.2 CVSS, allow unauthenticated attackers to execute code on web servers at the runtime level, with the highest risk on Apache mod_php setups; active exploitation attempts have already been observed, prompting urgent updates to PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fully protect servers. The PHP Foundation acknowledged delayed fixes due to past challenges but emphasized that patching is the only reliable mitigation, as configuration workarounds do not fully prevent exploitation.

https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html

Cloudflare Deploys Protections Against Php2shell Vulnerability

,

Cloudflare has implemented new Web Application Firewall (WAF) protections to defend against the php2shell vulnerability, a critical PHP exploit that allows attackers to execute arbitrary code on affected servers. These protective rules detect and block attempts to exploit this vulnerability, helping to safeguard websites from potential compromise without requiring immediate patching. This deployment enhances security for Cloudflare customers by mitigating risks posed by active exploits targeting php2shell flaws.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP Warns Admins of Two Critical Flaws, Emergency Patches Coming

,

The PHP development team has announced emergency security updates scheduled for October 21, 2026, to address two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP versions 5 through 8, each rated 9.2 on the CVSS v4.0 scale. Prior to the official release, details about these flaws were leaked, prompting organizations like Cloudflare to deploy temporary Web Application Firewall protections while urging administrators to apply the official patches promptly upon release.

https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

, ,

Security researcher Snorre Fagerland discovered autonomous AI agents, operated by a Chinese-speaking criminal, targeting over 1,200 company websites to breach them with minimal human input, including sites of major companies like Deere, SharkNinja, and Cummins. These AI-driven attacks used the open-source Cairn tool to gain persistent access by planting web shells, with an average success rate of about 10% and low operational costs, while exposed control panels also leaked sensitive data and credentials. NorForge is notifying victims and urging hosting providers to secure or remove these exposed AI agent control panels to prevent further compromises.

https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html

ENISA Threat Landscape 2026: Top Cyberattack Trends

, , , , , , ,

The ENISA Threat Landscape 2026 report highlights emerging cyberattack trends, emphasizing the increasing sophistication and automation of attacks targeting critical infrastructure and cloud environments. It forecasts a rise in ransomware, supply chain compromises, and AI-powered threats, urging organizations to enhance their cybersecurity defenses and resilience strategies.

https://blog.barracuda.com/2026/10/19/enisa-threat-landscape-2026-cyberattack-trends

F-Secure Scam Encyclopedia

, , ,

The F-Secure Scam Encyclopedia is a structured resource that catalogs over 50 online scam types across eight categories, focusing on the victim’s perspective to better understand how scams deceive and extract money. It provides detailed scam indicators, templates, and definitions centered on online criminal deception for financial gain targeting individual consumers, aiming to reveal underlying patterns behind constantly changing scam tactics.

https://www.f-secure.com/en/partners/illuminate-research/scam-encyclopedia

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

, , ,

Hackers exploited a compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 tenants, leveraging the app’s broad permissions to access mailboxes, files, and directory data. The attackers used the credential to obtain Microsoft Graph tokens and added themselves to privileged roles in some environments, escalating their access. ConnectWise has disabled the Cloud Backup application’s access while investigating and recommends tenants disable the app until the credentials are reset.

https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

, ,

Attackers are impersonating popular AI products to distribute malware and steal credentials in widespread fake AI campaigns targeting US companies, accounting for 16% of observed incidents. These campaigns strain MSSPs by generating repetitive investigations and increasing analyst workload, but solutions like ANY.RUN’s Interactive Sandbox and Threat Intelligence Feeds help MSSPs reduce response times, lower escalation rates, and improve detection by enabling behavioral analysis and intelligence sharing across customer environments. This coordinated approach allows MSSPs to maintain consistent service levels and scale protection efficiently amid evolving fake AI threats.

https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html

Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign

, , ,

Check Point researchers have identified a large-scale phishing campaign using fake Microsoft calendar invites to steal account credentials. Since late September 2026, over 300,000 phishing emails containing malicious .ics attachments or deceptive links have targeted more than 40,000 organizations, with daily attack volumes rapidly increasing through October. The campaign exploits user trust in calendar invites by delivering credential-harvesting links disguised as legitimate Microsoft login pages.

https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-target-thousands-of-organizations-in-microsoft-credential-phishing-campaign/

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

, ,

Researchers at Citizen Lab have uncovered how the Israeli company Discover-Tech exploited targeted online ads to deliver zero-click mercenary spyware, notably infecting devices at Al Jazeera with Candiru’s spyware through a technique dubbed AdFection. Discover-Tech operates a malicious ad targeting platform called Controlium, enabling spyware vendors to fingerprint, de-anonymize, and infect devices upon ad rendering, while its ads reached hundreds of thousands of websites and apps globally via major ad networks. Following disclosure, major vendors including Google and IAB Europe removed Discover-Tech from their platforms, highlighting significant risks in the online advertising ecosystem that facilitated espionage and privacy invasion.

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

The Hidden Network: Inside the Phishing Infrastructure Ecosystem Powering Global Cybercrime

Microsoft uncovered a large Chinese-language phishing ecosystem involving interconnected phishing kit developers, an illicit marketplace called YAM Store, and numerous threat actors leveraging compromised or fraudulent Microsoft and Google cloud environments to launch large-scale phishing and credential theft campaigns worldwide. YAM Store acts as an access broker selling hijacked Microsoft 365 and Azure tenants and related infrastructure, which phishing kit operators such as Iron Man System use to provide phishing-as-a-service tools enabling real-time credential harvesting and financial fraud across multiple sectors and countries. Microsoft disrupted the ecosystem’s core infrastructure and recommends user education and vigilance to mitigate these widespread social engineering and account takeover risks.

https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/

Global Takedown Hits Network Behind 1 Billion Phishing Messages

Law enforcement agencies and partners worldwide have dismantled a large cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations in 150 countries. The operation involved the YAM Store marketplace and phishing kits CoGUI, Haozi, and Iron Man, which exploited compromised Microsoft and Google accounts and employed sophisticated tactics like AI-generated fake organizations and geofencing to evade detection. Microsoft and collaborators seized domains, disabled accounts, and blocked malicious infrastructure to disrupt the campaign, which had particularly targeted Microsoft 365 customers with device-code phishing to steal authentication tokens.

https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/

Scroll to Top