Cyber Threat Intel Daily Briefing — 2026-10-23

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-23 12:15 UTC · REPORT BRIEF-20261023-121557

OPEN // LE

01

URGENT – PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The proje

SRC: The Hacker News Fri, 23 Oct 2026 16:55:43 +0530 https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

02

PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet

PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that hand

SRC: Security Affairs Fri, 23 Oct 2026 10:52:00 +0000 https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html

03

Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 09:58:34 +0000 https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/

04

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separa

SRC: The Hacker News Fri, 23 Oct 2026 15:06:00 +0530 https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html

05

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2

SRC: The Hacker News Fri, 23 Oct 2026 16:41:23 +0530 https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html

06

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 10:31:16 +0000 https://www.securityweek.com/china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks/

07

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 06:39:29 +0000 https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/

08

Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

SRC: DarkReading Thu, 22 Oct 2026 20:42:17 GMT https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack

09

11 Million Impacted by Capcom Data Breach

The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 08:34:14 +0000 https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/

10

State Bank of India Suffers a Customer PII Data Leak

Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

SRC: DarkReading Fri, 23 Oct 2026 03:30:00 GMT https://www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak

11

Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’

In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders. The post Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’ appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 08:25:06 +0000 https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/

12

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. […]

SRC: BleepingComputer Thu, 22 Oct 2026 17:25:31 -0400 https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/

13

LiteLLM Compromised in Fresh Supply Chain Attack

Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 08:10:46 +0000 https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/

14

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 07:54:47 +0000 https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/

15

Meta Faces $25 Billion Penalty Linked to Cambridge Analytica Scandal

A New Mexico judge ordered Meta to pay $25 billion for misleading users about privacy, setting a record penalty. Meta plans to appeal. This week a New Mexico judge ordered Meta to pay the state $25 billion. The order follows a jury finding that the company deceived Facebook users about their privacy

SRC: Security Affairs Fri, 23 Oct 2026 11:42:24 +0000 https://securityaffairs.com/201582/laws-and-regulations/meta-faces-25-billion-penalty-linked-to-cambridge-analytica-scandal.html

16

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace af

SRC: The Hacker News Thu, 22 Oct 2026 23:42:43 +0530 https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html

17

Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber

One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation. The post Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber a

SRC: CyberScoop Thu, 22 Oct 2026 17:37:24 +0000 https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/

18

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York

SRC: The Hacker News Thu, 22 Oct 2026 21:42:31 +0530 https://thehackernews.com/2026/10/meta-ordered-to-pay-25-billion-after.html

[ SOURCE ] OpenPhish (18 indicator(s))