AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
Also covered by Unit 42 (Palo Alto), Kaspersky Securelist, Sucuri Blog, Tenable Blog +more
Nefilim and Hive ransomware affiliate gets 70 months in prison
A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. [...]
Also covered by Krebs on Security, CyberScoop
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
Also covered by Unit 42 (Palo Alto), Cisco Talos
FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific…
Also covered by Krebs on Security
ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th)
Also covered by Rapid7 Blog
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting…
Also covered by BleepingComputer
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
Also covered by HackRead
CVE-2026-111497 added to CISA KEV — Google Brotli
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute…
Also covered by Tenable Blog
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
Also covered by SC Media
26th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which…
Also covered by Wordfence
PHP2Shell: What to know about two critical PHP flaws
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
Also covered by Graham Cluley
Siemens Software Center
View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application…
Also covered by CISA Known Exploited Vulnerabilities
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique
Stop PHP2Shell with SentinelOne. Learn how Singularity Agent stops web worker post-exploitation, kills process trees, and hunts threats.
Also covered by CrowdStrike
CVE-2026-102764 added to CISA KEV — BeyondTrust Remote Support
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Also covered by Rapid7 Blog
Security Alert: Microsoft Releases October 2026 Security Updates
Also covered by Qualys Blog
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Also covered by CrowdStrike
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 .
Also covered by GitHub Security Blog
2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE)…
Also covered by Cloudflare Security
A Deep Dive into the GetProcessHandleFromHwnd API
In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I…
Also covered by Bitdefender Labs
CrowdStrike Uncovers New Agentic AI Campaigns
Also covered by GreyNoise Labs