Cyber Threat Intel Daily Briefing — 2026-10-21

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-21 12:15 UTC · REPORT BRIEF-20261021-121504

OPEN // LE

01

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out o

SRC: The Hacker News Wed, 21 Oct 2026 16:06:53 +0530 https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html

02

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to

SRC: The Hacker News Wed, 21 Oct 2026 16:00:27 +0530 https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html

03

Microsoft says October updates didn’t actually fix VPN issues

Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. […]

SRC: BleepingComputer Wed, 21 Oct 2026 06:14:53 -0400 https://www.bleepingcomputer.com/news/microsoft/microsoft-didnt-actually-fix-vpn-issues-caused-by-windows-updates/

04

PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The up

SRC: Security Affairs Wed, 21 Oct 2026 10:13:52 +0000 https://securityaffairs.com/201403/security/php-prepares-emergency-fixes-for-two-critical-remote-code-execution-flaws.html

05

CISA: SafePay ransomware hit over 600 critical infrastructure orgs

The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. […]

SRC: BleepingComputer Wed, 21 Oct 2026 04:36:24 -0400 https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/

06

China Defends DeepSeek After US Ban of Its AI From Government Systems

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems. The post China Defends DeepSeek After US Ban of Its AI From Government Systems appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 10:54:49 +0000 https://www.securityweek.com/china-defends-deepseek-after-us-ban-of-its-ai-from-government-systems/

07

Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable. The post Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 10:03:24 +0000 https://www.securityweek.com/chinese-ai-model-writes-more-hackable-code-when-told-its-for-us-contractor/

08

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy information technology produ

SRC: The Hacker News Wed, 21 Oct 2026 13:34:17 +0530 https://thehackernews.com/2026/10/us-orders-deepseek-removed-from-federal.html

09

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisa

SRC: The Hacker News Wed, 21 Oct 2026 11:35:15 +0530 https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html

10

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugi

SRC: The Hacker News Wed, 21 Oct 2026 14:31:12 +0530 https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html

11

State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "

SRC: The Hacker News Wed, 21 Oct 2026 13:14:22 +0530 https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

12

Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. […]

SRC: BleepingComputer Tue, 20 Oct 2026 21:01:50 -0400 https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/

13

Zeabur shutting down after second security breach in two months

Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. […]

SRC: BleepingComputer Tue, 20 Oct 2026 15:33:02 -0400 https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/

14

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 20 Oct 2026 13:51:01 +0000 https://www.securityweek.com/aomei-backupper-compromised-in-short-burst-supply-chain-campaign/

15

Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys

The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them. The post Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 11:22:05 +0000 https://www.securityweek.com/browsers-block-emudhra-intermediate-cas-over-recoverable-private-keys/

16

The Harness Is the Hard Part of Agentic Pentesting

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness i

SRC: The Hacker News Wed, 21 Oct 2026 16:02:40 +0530 https://thehackernews.com/2026/10/the-harness-is-hard-part-of-agentic.html

17

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 06:02:27 +0000 https://www.securityweek.com/hijacked-developer-account-used-to-plant-stealer-in-ovhcloud-cli/

18

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training. The post Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 04:22:11 +0000 https://www.securityweek.com/accenture-dragos-sans-launch-10m-initiative-to-defend-small-us-utilities/

[ SOURCE ] OpenPhish (18 indicator(s))