Cybersecurity Brief – 2026-10-26

Mon, 26 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Genesys disclosed a security incident exposing customer data from internal systems. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected ^[23].
Quest Diagnostics reported a breach impacting patient records and personal information ^[32].
953 online stores were found infected as part of a long-running malware campaign, where injected loader code served malicious payloads or remained dormant to avoid detection ^[26].
A Chinese national was extradited to the US for alleged involvement in a cryptocurrency investment scam that defrauded 174 victims of nearly $37 million ^[13].

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being actively exploited in the wild. Industrial vendors including Siemens, Schneider Electric, and ABB confirmed some products are affected. Exploitation has shifted from probing to successful shell deployments against honeypots ^[15]^[22]^[25].
Two critical flaws were disclosed in Wasmtime, a WebAssembly runtime, allowing malicious modules to escape the intended sandbox ^[4].
An out-of-bounds write flaw in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, enabling code execution and prompting widespread patching efforts ^[28].
Unpatched vulnerabilities in Tailscale SSH allow a compromised device to gain root access on other reachable servers within the network ^[10].
The update process for the abandoned Popcorn Time streaming app was found to leave millions of devices exposed to remote hijacking ^[30].

Notable Threat Actor Activity

Ongoing exploitation attempts targeting the PHP2Shell vulnerabilities have been observed, with evidence of successful post-exploitation activity and suspected global scanning by North Korean actors ^[11]^[15]^[25].
An automated campaign, dubbed Gheist, is using stolen GitHub tokens to inject workflows that exfiltrate repository secrets via GitHub Actions logs ^[8].
A Microsoft 365 campaign has compromised 97 accounts across 79 organisations by leveraging adversary-in-the-middle relay attacks to capture and replay authentication tokens ^[7].
The uCreator Android spyware kit is being rented out to steal Telegram 2FA passwords and clone WeChat accounts by embedding itself in trojanised versions of the apps ^[6].
Dutch police arrested two individuals for conducting NFC relay attacks that drained over $400,000 from bank accounts, involving social engineering to trick victims into installing malicious apps and scanning credit cards ^[27].

Trends, Tools, or Tactics of Interest

Multiple headlines highlight the proliferation of RCE vulnerabilities, with attackers rapidly scanning for and exploiting new bugs such as PHP2Shell, Node2Shell, and others ^[3]^[28].
Attackers are leveraging malicious instruction files (e.g., AGENTS.md) placed in developer environments to hijack AI coding agents and install malicious npm packages ^[9]^[16].
New guidance from NIST, CISA, and NSA recommends treating incidents involving autonomous AI agents as standard security events, with a focus on tracking agent identity and authority ^[12].
Stolen reasoning traces from OpenAI models may facilitate the creation of cheaper rival AI systems, following a flaw in OpenAI’s compaction process ^[24].
Kali Linux 2026.3 was released, introducing six new security tools and desktop environment updates ^[14].
YARA-X 1.22.0 was released, delivering 11 improvements and 9 bugfixes ^[21].

Regulatory or Policy Developments

No significant regulatory or policy developments affecting the security industry were reported in the provided headlines.

Sources

Genesys Hack Exposes Customer Data From Internal Systems - securityweek.com
Patient records exposed in Quest breach: What you need to know - malwarebytes.com
953 Online Stores Infected in Long-Lasting Malware Campaign - securityweek.com
Chinese man extradited for role in $36 million cryptocurrency scam - bleepingcomputer.com
PHP2Shell security flaws now sucessfully exploited in the wild - bleepingcomputer.com
Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
PHP2Shell Exploitation Moves From Probes to Working Shells - securityweek.com
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes - thehackernews.com
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages - securityweek.com
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers - thehackernews.com
Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity - thehackernews.com
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs - thehackernews.com
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations - thehackernews.com
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts - thehackernews.com
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts - securityweek.com
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware - thehackernews.com
AI coding agents hijacked using AGENTS.md file in Downloads folder - bleepingcomputer.com
When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
Stolen AI Reasoning Could Help China Build Cheaper Rivals - securityweek.com
Kali Linux 2026.3 released with 6 new tools, desktop updates - bleepingcomputer.com
YARA-X 1.22.0 Release, (Sun, Oct 25th) - isc.sans.edu

Wasmtime on DanSec Daily

Cybersecurity Brief – 2026-10-26

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Sources