Saturday 24 October 2026

Major Incidents or Breaches

• Quest Diagnostics confirmed a data breach in which patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system ^[15].
• Capcom warned of phishing risks after the exposure of 11.7 million records, including email addresses of CAPCOM ID users. Unauthorised password changes were detected on 196 accounts ^[31].
• LiteLLM disclosed that a master key was accidentally published to a public GitHub repository, allowing attackers to push a malicious version of the agent platform and steal GitHub tokens, resulting in the potential hijack of the release pipeline ^[4].
• Researchers disabled a vulnerable updater in the abandoned Time4Popcorn app (a Popcorn Time fork), mitigating a remote code execution risk that could have affected millions of devices ^[6][12].

Newly Discovered Vulnerabilities

• A memory-corruption flaw in Google’s Brotli decoder affects multiple widely used software components, including Node.js, Bun, Python Brotli packages, and Envoy proxies, enabling potential remote code execution ^[3].
• Two actively exploited critical vulnerabilities were identified in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, leading CISA to add them to its Known Exploited Vulnerabilities catalog ^[7].
• Hewlett Packard Enterprise released security updates for 72 ArubaOS vulnerabilities, including eight with maximum severity that allow authentication bypass and remote code execution ^[18].
• Ruby released updates to address three bugs in its Onigmo regular expression engine, which were responsible for four critical remote code execution flaws in GitLab ^[9].
• PHP is affected by a new remote code execution vulnerability, for which only mitigation guidance is available as no patch exists. The vulnerability, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is being actively discussed and targeted ^{[16][20][24][25][26][27][29]}.
• PHP2Shell vulnerability attempts have been linked to Mirai botnet operators, with researchers demonstrating ASLR bypass exploits, though no successful compromises have been confirmed ^[29].

Notable Threat Actor Activity

• Diplomatic organizations in Central Asia were targeted by the BlackX UEFI bootkit, which bypasses Secure Boot on patched Windows systems lacking revocations ^[8].
• Ransomware affiliates of the INC and The Gentlemen groups have been observed using AI-driven agents to execute intrusions, leveraging an ecosystem that automates tasks such as credential harvesting and lateral movement ^[10].
• A large-scale campaign has targeted exposed enterprise firewalls and VPNs (Fortinet FortiGate and Palo Alto Networks GlobalProtect), resulting in the exposure of over 70,000 credentials ^[11].
• Russia’s APT28 targeted NATO defense firms, as reported in a broader summary of recent threat actor activity ^[28].
• Mirai botnet operators have joined in exploiting the PHP2Shell vulnerability ^[29].

Trends, Tools, or Tactics of Interest

• Attackers are increasingly using legitimate calendar invite files (ICS format) in phishing attacks to evade security filters ^[1].
• AI tools are being used to generate large-scale attacks at low cost, including campaigns that achieve full domain control using public models for minimal expense ^[21].
• Infostealer malware is evolving to include AI-driven collection routines in addition to traditional data theft tactics ^[30].
• Threat actors are bypassing technical controls by calling help desks and using social engineering, sometimes augmented by AI, to gain access without malware ^[19].
• AI agents can be manipulated through malicious content to execute commands, steal data, or delete files using their legitimate permissions ^[17].
• Microsoft announced upcoming AI-powered, context-aware phishing detection for Teams, to be rolled out in early November 2026 ^[13].
• Banks have detected rogue AI agents as part of recent threat activity ^[28].

Regulatory or Policy Developments Affecting the Security Industry

• Google updated its privacy policy to clarify that data from Gmail and Photos, when used with personalized AI features in Search or Gemini, may be used for targeted advertising ^[5].
• Microsoft announced that Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates after that date ^[14].
• The U.S. FBI and CISA issued joint advisories warning of election-themed phishing and spear phishing attacks targeting voters and election officials ahead of the US midterm elections ^[2].
• CISA added two actively exploited vulnerabilities (Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator) to its Known Exploited Vulnerabilities catalog ^[7].

Sources

1. Quest Diagnostics confirms data breach exposed patient records - bleepingcomputer.com
2. Resident Evil maker Capcom warns of phishing after 11.7 million records exposed - malwarebytes.com
3. Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - thehackernews.com
4. Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - thehackernews.com
5. Abandoned Popcorn Time app exposed millions of devices to RCE attacks - bleepingcomputer.com
6. Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - thehackernews.com
7. CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - thehackernews.com
8. HPE patches eight max severity RCE and auth bypass AOS flaws - bleepingcomputer.com
9. Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - thehackernews.com
10. PHP shares mitigation for new RCE vulnerability with no patch - bleepingcomputer.com
11. Exposed to PHP2Shell? Cyber Experts Weigh in With Advice - darkreading.com
12. The PHP Meltdown Shows How AI Makes Bugs More Exploitable - wired.com
13. (Reliable)? php2shell exploitability, (Fri, Oct 23rd) - isc.sans.edu
14. PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) - isc.sans.edu
15. PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure - portswigger.net
16. Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge - securityweek.com
17. BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - thehackernews.com
18. Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions - thehackernews.com
19. Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - thehackernews.com
20. In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware - securityweek.com
21. Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters - blog.knowbe4.com
22. AI Tools Are Generating Massive Attacks for Little Cost - darkreading.com
23. Infostealer riding the AI Train - research.checkpoint.com
24. Trust Is Not What It Seems — And Fraudsters Are Counting on It - darkreading.com
25. You gave your AI agent access, but who is giving it orders? - bleepingcomputer.com
26. Microsoft Teams to get AI-powered, context-aware phishing detection - bleepingcomputer.com
27. Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads - thehackernews.com
28. Microsoft: Windows Server 2016 reaches end of support in January - bleepingcomputer.com
29. FBI Warns of Phishing Attacks Ahead of the US Midterm Elections - blog.knowbe4.com