Cyber Threat Intel Daily Briefing — 2026-10-26

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-26 12:15 UTC · REPORT BRIEF-20261026-121518

OPEN // LE

01

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 26 Oct 2026 10:21:57 +0000 https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/

02

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP

SRC: Security Affairs Mon, 26 Oct 2026 09:58:31 +0000 https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html

03

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. […]

SRC: BleepingComputer Mon, 26 Oct 2026 05:19:57 -0400 https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/

04

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls o

SRC: The Hacker News Sun, 25 Oct 2026 23:14:09 +0530 https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html

05

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the

SRC: The Hacker News Mon, 26 Oct 2026 15:24:02 +0530 https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html

06

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between J

SRC: The Hacker News Mon, 26 Oct 2026 14:05:51 +0530 https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html

07

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an an

SRC: The Hacker News Mon, 26 Oct 2026 13:19:46 +0530 https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html

08

Security Affairs newsletter Round 601 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Address

SRC: Security Affairs Sun, 25 Oct 2026 12:28:47 +0000 https://securityaffairs.com/201698/breaking-news/security-affairs-newsletter-round-601-by-pierluigi-paganini-international-edition.html

09

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent be

SRC: The Hacker News Mon, 26 Oct 2026 11:33:48 +0530 https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html

10

AI coding agents hijacked using AGENTS.md file in Downloads folder

Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. […]

SRC: BleepingComputer Sun, 25 Oct 2026 11:49:38 -0400 https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/

11

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts. The post Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 26 Oct 2026 11:47:52 +0000 https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/

12

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all even

SRC: The Hacker News Mon, 26 Oct 2026 16:53:56 +0530 https://thehackernews.com/2026/10/between-alerts-what-attackers-do-in.html

13

Kali Linux 2026.3 released with 6 new tools, desktop updates

Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. […]

SRC: BleepingComputer Mon, 26 Oct 2026 06:26:52 -0400 https://www.bleepingcomputer.com/news/linux/kali-linux-20263-released-with-6-new-tools-desktop-updates/

14

Mythos 5 Ignored Real-World Harm in July Attack

The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub. The post Mythos 5 Ignored Real-World Harm in July Attack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 26 Oct 2026 09:10:03 +0000 https://www.securityweek.com/mythos-5-ignored-real-world-harm-in-july-attack/

[ SOURCE ] OpenPhish (18 indicator(s))