Major Incidents or Breaches

  • Genesys disclosed a security incident exposing customer data from internal systems. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected [23].
  • Quest Diagnostics reported a breach impacting patient records and personal information [32].
  • 953 online stores were found infected as part of a long-running malware campaign, where injected loader code served malicious payloads or remained dormant to avoid detection [26].
  • A Chinese national was extradited to the US for alleged involvement in a cryptocurrency investment scam that defrauded 174 victims of nearly $37 million [13].

Newly Discovered Vulnerabilities

  • Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being actively exploited in the wild. Industrial vendors including Siemens, Schneider Electric, and ABB confirmed some products are affected. Exploitation has shifted from probing to successful shell deployments against honeypots [15][22][25].
  • Two critical flaws were disclosed in Wasmtime, a WebAssembly runtime, allowing malicious modules to escape the intended sandbox [4].
  • An out-of-bounds write flaw in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, enabling code execution and prompting widespread patching efforts [28].
  • Unpatched vulnerabilities in Tailscale SSH allow a compromised device to gain root access on other reachable servers within the network [10].
  • The update process for the abandoned Popcorn Time streaming app was found to leave millions of devices exposed to remote hijacking [30].

Notable Threat Actor Activity

  • Ongoing exploitation attempts targeting the PHP2Shell vulnerabilities have been observed, with evidence of successful post-exploitation activity and suspected global scanning by North Korean actors [11][15][25].
  • An automated campaign, dubbed Gheist, is using stolen GitHub tokens to inject workflows that exfiltrate repository secrets via GitHub Actions logs [8].
  • A Microsoft 365 campaign has compromised 97 accounts across 79 organisations by leveraging adversary-in-the-middle relay attacks to capture and replay authentication tokens [7].
  • The uCreator Android spyware kit is being rented out to steal Telegram 2FA passwords and clone WeChat accounts by embedding itself in trojanised versions of the apps [6].
  • Dutch police arrested two individuals for conducting NFC relay attacks that drained over $400,000 from bank accounts, involving social engineering to trick victims into installing malicious apps and scanning credit cards [27].

Trends, Tools, or Tactics of Interest

  • Multiple headlines highlight the proliferation of RCE vulnerabilities, with attackers rapidly scanning for and exploiting new bugs such as PHP2Shell, Node2Shell, and others [3][28].
  • Attackers are leveraging malicious instruction files (e.g., AGENTS.md) placed in developer environments to hijack AI coding agents and install malicious npm packages [9][16].
  • New guidance from NIST, CISA, and NSA recommends treating incidents involving autonomous AI agents as standard security events, with a focus on tracking agent identity and authority [12].
  • Stolen reasoning traces from OpenAI models may facilitate the creation of cheaper rival AI systems, following a flaw in OpenAI’s compaction process [24].
  • Kali Linux 2026.3 was released, introducing six new security tools and desktop environment updates [14].
  • YARA-X 1.22.0 was released, delivering 11 improvements and 9 bugfixes [21].

Regulatory or Policy Developments

  • No significant regulatory or policy developments affecting the security industry were reported in the provided headlines.

Sources#

  1. Genesys Hack Exposes Customer Data From Internal Systems - securityweek.com
  2. Patient records exposed in Quest breach: What you need to know - malwarebytes.com
  3. 953 Online Stores Infected in Long-Lasting Malware Campaign - securityweek.com
  4. Chinese man extradited for role in $36 million cryptocurrency scam - bleepingcomputer.com
  5. PHP2Shell security flaws now sucessfully exploited in the wild - bleepingcomputer.com
  6. Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
  7. PHP2Shell Exploitation Moves From Probes to Working Shells - securityweek.com
  8. Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes - thehackernews.com
  9. Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages - securityweek.com
  10. Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers - thehackernews.com
  11. Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
  12. PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity - thehackernews.com
  13. Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs - thehackernews.com
  14. Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations - thehackernews.com
  15. uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts - thehackernews.com
  16. Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts - securityweek.com
  17. ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
  18. Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware - thehackernews.com
  19. AI coding agents hijacked using AGENTS.md file in Downloads folder - bleepingcomputer.com
  20. When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
  21. Stolen AI Reasoning Could Help China Build Cheaper Rivals - securityweek.com
  22. Kali Linux 2026.3 released with 6 new tools, desktop updates - bleepingcomputer.com
  23. YARA-X 1.22.0 Release, (Sun, Oct 25th) - isc.sans.edu