[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongEmerging Threats
Hackers Exploit PHP2Shell Vulnerabilities by the Millions
The floodgates have opened: just four days before patches were released, attackers launched a staggering millions of attempts to exploit two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, with Cloudflare reporting an explosion from thousands to millions of exploitation attempts in mere hours.
GitLab Patches Max-Severity Flaw Exploited in Code Execution Attacks
GitLab has patched a critical flaw that allowed hackers to execute malicious code on its servers, thanks to an integer overflow vulnerability in its Regular Expression Compiler that could be triggered by a specially crafted regular expression. This max-severity vulnerability, tracked as CVE-2026-110264, could be exploited by unauthenticated users, posing a huge risk to GitLab users.
Railway Breach Exposes Customer Secrets, Fuels AI-Powered Threats
A security breach at Railway exposed sensitive customer secrets, with a cryptocurrency theft transaction detected at least two hours before the incident was officially disclosed. The breach allowed an unauthorized third party to potentially access encrypted environment variables, affecting a subset of users.
Microsoft Exposes Chinese State Actor's AI-Driven Cloud Breach Tactics
Microsoft uncovered a brazen AI-driven cloud breach by a Chinese state actor, who attempted to sign in to over 2,250 tenants at a staggering 2,900 attempts per minute - leaving defenders scrambling to keep up. The actor, tracked as Storm-0940, used a sophisticated AI-powered tool called ARTEX to automate and accelerate its attacks.
Amazon Detects Early PHP2Shell Exploitation Attempt Before Disclosure
Amazon's Threat Intelligence team detected a sneaky attempt to exploit a critical PHP vulnerability on October 17, four days before the flaw was even publicly disclosed. This early warning sign came from Amazon's internal honeypot system, MadPot, which caught an IP address linked to a commercial anonymization network, hinting at a threat actor at play.
Threat Actors Exploit PHP2Shell Vulnerabilities Before Public Disclosure
Threat actors made a move to exploit PHP2Shell vulnerabilities just four days before they were publicly disclosed, with a suspicious probe detected by Amazon's Threat Intelligence team on October 17, 2026, originating from an anonymized IP address in Australia. This early attempt suggests that malicious actors had somehow gotten wind of the vulnerability before its scheduled reveal.
LiteLLM Exposes GitHub Token Leak Behind Malicious Package Release
A recent investigation revealed that a GitHub token leak was behind a malicious package release, specifically when Claude Code embedded a user's GitHub CLI OAuth token into a response body, potentially exposing it in LiteLLM logs. This led to a compromised release pipeline and a poisoned package, LiteLLM v1.107.0, being pushed to multiple registries on October 21, 2026.
Interpol Disrupts 11,000 African Cybercrime Networks
Thanks to Interpol's Operation Serengeti III, a massive blow has been dealt to African cybercrime networks, with 11,000 networks disrupted and a huge dent put in the operations of scammers, ransomware attackers, and business email compromise crooks. This game-changing effort was made possible by a collaboration between 21 countries and tech partners like Team Cymru, Kaspersky, and Fortinet.
Microsoft Warns of China-Linked Hackers Using AI in Supply Chain Attacks
Microsoft warns that China-linked hackers are leveraging AI to supercharge supply chain attacks, allowing them to swiftly exploit compromised apps and gain access to target environments. This alarming tactic was recently used to breach the ConnectWise Cloud Backup application.
Threat Actor Wields AI in Multiform Cybercrime Spree
Meet BUGSTER, a cunning threat actor who's taking cybercrime to the next level with AI - and getting away with it all from a single US server. This tech-savvy crook is using AI-powered tools to pull off a wide range of crimes, from credential theft and data exfiltration to VoIP fraud and cryptocurrency reconnaissance.
NSA, FBI Warn of PHP Flaws, Urge Immediate Updates
Millions of websites are at risk due to critical PHP flaws, known as "php2shell", that allow hackers to take control of vulnerable servers, steal sensitive data, and wreak havoc online - and experts are urging immediate updates to prevent disaster.
Microsoft Links ConnectWise Breach to China-Aligned Threat Group
Microsoft researchers have uncovered a concerning supply-chain intrusion linked to a China-aligned threat group, Storm-0940, which has been using AI-driven tooling to automate attacks on hundreds of organizations across various industries. This group has been active since 2021 and has leveraged a cutting-edge framework called ARTEX to streamline its malicious operations.
Hackers Breach Japan's Onamae Desktop Cloud, Compromise 27,000 Servers
A massive security breach has hit Japan's Onamae Desktop Cloud, compromising a staggering 27,000 servers and putting customer data at risk. A third-party hack installed malicious programs in some server environments, prompting swift action from the company to contain the damage.
Lazarus Hackers Deploy Post-Quantum Encryption for Malware Delivery
The Lazarus hackers are taking malware delivery to the next level by using post-quantum encryption, a cutting-edge technique that makes it extremely difficult to detect their malicious activities. By embedding ML-KEM-1024, a NIST-approved mechanism, into their malware, they're future-proofing their attacks against even the most advanced security systems.
Malicious LiteLLM Package Exposes Cloud and AI Credentials
A malicious version of the popular LiteLLM package, downloaded a staggering 23 million times weekly, was compromised by unknown hackers who stole cloud and AI credentials and installed a remote access trojan. If you ran version 1.107.0 on any platform, assume your secrets have been stolen and take immediate action.
CISA Warns of Active Plex Vulnerability Exploits
Got it, thanks for the heads up: CISA is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server, known as Plex2Shell, that can lead to full server compromise if left unpatched. Federal agencies have been directed to prioritize patching or apply mitigations by October 23.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
LiteLLM Python Package Compromised in Supply Chain Attack
Malicious hackers infiltrated the LiteLLM Python package through a supply chain attack, using stolen GitHub credentials to compromise version 1.107.0 and distribute it through PyPI and Docker. The package has since been quarantined and malicious images removed.
PHP Rushes Emergency Patches for High-Severity Vulnerabilities
The PHP project has rushed out an emergency release to fix two critical remote-code-execution flaws, with early attacks already emerging, prompting an urgent call to update to patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This swift action aims to prevent exploitation of the vulnerabilities, dubbed "php2shell," which have been rated 9.2 on the CVSS v4.0 scale.
PHP Vulnerabilities Spark Widespread Exploitation Fears
A critical alert has been issued for PHP users, with nearly 70% of websites needing to update their core software to patch two severe vulnerabilities that could give attackers full control over affected servers. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are already being exploited, causing outages and putting websites at risk of denial of service, remote code execution, and data exposure.
AI-Powered Phishing Platform Exposes New Threats to Enterprise Security
Imagine a phishing platform so stealthy, it's being used to send nearly 90,000 attack-related messages to over 2,200 organizations across the US and Europe - and that's just in six months. Meet Athena StealthRoute, the latest threat to enterprise security that's making waves in the world of Phishing as a Service.
Symantec Exposes AI-Powered Cyber-Attack Agent Capable of Autonomous Actions
Symantec researchers have uncovered a sophisticated AI-powered cyber-attack agent that can operate autonomously, cleverly shifting its operational costs to unsuspecting victims by hijacking their resources. This sneaky tactic was exposed when the researchers set up an AI honeypot, which attracted over 127,000 external requests from tens of thousands of unique addresses.
ClickFix Attacks Surge with AI Tools as Lure
ClickFix attacks are exploding, now making up a whopping 52% of detections on average through Q2 2026, with the number surging to 67% in August alone. This technique's rapid growth shows no signs of slowing, with Microsoft reporting a 23x increase in ClickFix-style attacks between December 2025 and May 2026.
Ransomware Attacks Surge as Rival Gangs Intensify Market Rivalry
Ransomware attacks are surging like never before, with a 50% year-over-year spike in incidents, according to Nord Security's latest quarterly tally. The company recorded 2,894 ransomware incidents between July and September 2026, marking a significant jump from the same period in 2025.
AI Lowers Barriers for Critical Infrastructure Attacks
AI is lowering the barriers to launching critical infrastructure attacks, making it easier for malicious actors to carry out complex assaults with less technical know-how. This alarming trend was highlighted in a recent study by AI pentesting company Frenos, which tested AI models against industrial control systems.