This Week in Cybersecurity
The loudest story was PHP2Shell. Two CVSS 9.2 flaws in PHP (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution, and CISA added them to the KEV catalog after honeypots saw working exploitation. Federal agencies must patch by October 29, and researchers count more than 32 million exposed services. Edge devices were under pressure too. Citrix's NetScaler zero-days have been exploited since mid-September, and HPE Aruba fixed 72 flaws, eight of them max severity.
On the human side, Microsoft Teams is now a standard ransomware entry point. Attackers flood a mailbox, then message the victim from an external Teams account posing as IT support, and walk them into installing a remote management tool. Supply-chain trust failed in quieter ways as well: a Brazilian skimming group tampered with an analytics script served to Convertr merchants, and a dead Popcorn Time updater was still running unsigned code from lapsed domains.
Healthcare and government took hits. UNM Health System diverted ambulances and closed 30+ clinics, GMO Internet told customers to power off PCs amid a ¥8 billion extortion demand, and a UK watchdog found police data repeatedly exposed through third-party suppliers.
Top Stories
CISA Confirms PHP2Shell Vulnerabilities Are Now Exploited in Attacks
CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE flaws in PHP (CVSS 9.2), now in CISA KEV with a federal deadline of October 29. Patches shipped October 21. Inventory every PHP runtime, including the ones inside containers and legacy apps, and apply the fix before assuming exposure is low.
External Teams Chats Anchor 15-Minute Malware Delivery
A wide-scale social engineering campaign, possibly tied to Black Basta, pairs email bombing with external Microsoft Teams chats to get repeatable initial access in about 15 minutes. If your tenant accepts chats from external domains by default, restrict it and tell your help desk that IT will never cold-message users on Teams and ask them to install software.
Hackers Hijack Convertr Analytics Script to Steal Payment Card Data
A Brazilian skimming group tampered with a Plausible tracker served to Convertr merchants' checkout pages, harvesting card numbers, CVVs and CPF data. Third-party scripts on payment pages are a standing risk. Use a strict Content Security Policy and subresource integrity where you can, and audit what actually loads at checkout.
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Eye Security found an abandoned Popcorn Time fork that still fetched and ran unsigned code from lapsed update domains, with SYSTEM or root rights on millions of devices. Anyone could have registered a domain and taken over those machines. Abandoned software with a live auto-updater is a takeover waiting to happen, so remove it rather than leave it.
What the NetScaler Zero-Days Tell Us About the New Normal for Edge Patching
Citrix patched unauthenticated RCE flaws that were exploited from mid-September. A SecurityWeek column argues that emergency, after-hours patching of edge devices is now routine. Plan for it: know who can approve an out-of-window change and how quickly you can reach every gateway.
Security Corner
10 new advisories published to the Security Advisories section this week, including one added to CISA KEV.
CVE-2026-48356 — Adobe Commerce and Magento Unrestricted File Upload (CISA KEV) An unrestricted dangerous file upload flaw that can lead to code execution is now on the KEV list. It fits the wider Magento picture: Sansec linked 953 infected stores to a scanner-evading JavaScript campaign this week. Patch and review your CMS blocks for injected scripts. Full advisory →
CVE-2026-65184 — Root wsserver Daemon Command Injection (CVSS 9.8)
A root-privileged terminal-bridge daemon passes unsanitized WebSocket fields to system() and popen(), giving unauthenticated command execution as root.
Full advisory →
CVE-2026-116235, CVE-2026-116234 and CVE-2026-116233 — Oray Pugongying X5 Pro CRLF Injection (CVSS 9.1) Three CRLF injection flaws in the L2TP authentication, IPsec policy and Dnsmasq components of version 7.6.1. Public exploits exist and no fix is reported, so keep the management interface off untrusted networks. L2TP → · IPsec → · Dnsmasq →
Also this week:
- CVE-2026-111820 — Unauthenticated stored XSS via the page title in the Analytics Insights WordPress plugin up to 6.3.12 (CVSS 7.2) →
- CVE-2026-116110 — Missing authentication on the LiveWallPaper 2.6.8.0 SignalR Hub upload endpoint; public PoC (CVSS 7.3) →
- CVE-2026-116094 — SSRF in EyouCMS up to 1.8.3 via
remote_file_to_local; public exploit (CVSS 7.3) → - CVE-2026-116062 — SQL injection in SourceCodester Performance Indicator System 1.0
save_profile.php(CVSS 7.3) → - CVE-2026-116061 — SQL injection in the same product's
edit_dealer.php(CVSS 7.3) →
Quick Takes
- Apple Backports CoreGraphics Zero-Day Fix to Older iPhones: The CVE-2026-86950 fix reaches iOS 18.7.11, while iOS 27.2 patches 286 bugs. Read more →
- HPE Aruba Patches 72 Flaws: Eight max-severity bugs in AOS-8 and AOS-10 allow unauthenticated RCE and authentication bypass. Read more →
- Warp Discloses Breach Exposing AI Agent Logs: A third-party vendor compromise exposed agent decision logs and telemetry for roughly 1% of users. Read more →
- Japan's GMO Urges Customers to Shut Down PCs: An intruder stole data and demanded ¥8 billion, threatening a ransomware payload. Read more →
- Hackers Repeatedly Breached Suppliers Holding UK Police Data: The watchdog cites weak contract assurance and little log visibility. Read more →
- Nefilim and Hive Affiliate Sentenced to 70 Months: Artem Stryzhak pleaded guilty in December 2025. Read more →
- UNM Health System Diverts Ambulances, Closes 30+ Clinics: A network security breach alert on October 26 triggered the shutdown. Read more →
- Brotli Flaw: PHP Rebuilds Windows Packages: Experts temper alarm, with no in-the-wild exploitation of CVE-2026-111497 so far. Read more →
- Gheist Weaponizes Stolen GitHub Tokens: Wiz tracks 13,500+ malicious branches across 850+ accounts dumping cloud secrets. Read more →
- Former Pentester Used ARTEX AI to Steal 8.2M Records: Seoul police arrested seven suspects tied to 90+ Korean organizations. Read more →
- When an AI Agent Is the Incident: A NIST, CISA and NSA guide treats runaway agents as incidents to rehearse. Read more →
- Kali Linux 2026.3 Released: Six new tools, kernel 7.1 and KDE Plasma 6.7. Read more →
- OpenAI Launches GPT-6.1 Terra: Faster agents and 50% lower pricing, live in ChatGPT Work, Codex and the API. Read more →
Upcoming
Patch PHP first. The CISA deadline for PHP2Shell is October 29, and exploitation is already confirmed, so check every runtime you own, including containers and vendor appliances that bundle PHP. Review Microsoft Teams external access settings and brief your help desk on the email-bombing plus fake-IT-support pattern. If you run Magento or Adobe Commerce, apply the CVE-2026-48356 fix and scan CMS blocks for injected JavaScript. Review third-party scripts on any payment page, and retire abandoned software that still auto-updates. Edge teams should confirm NetScaler and Aruba firmware status. We'll follow PHP2Shell exploitation, the Teams campaign and the Brotli patch rollout in next week's digest.
CosmicBytez Labs — IT & Cybersecurity Intelligence Hub