Daily Cybersecurity News – October 23, 2026
CyberRecaps is supported by its readers. We may earn an affiliate commission at no extra cost to you if you buy through a link on this page.
PHP Warns of New Unpatched RCE Days After PHP2Shell Fixes
MediumWhat happened
PHP issued an informational advisory on October 23 warning of a separate remote code execution path two days after emergency patches for the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).
The new issue requires an unusual combination: an application sets session.serialize_handler to php_binary or php_serialize, then switches it to php via ini_set() before session_start(), while session upload progress remains enabled. PHP views the risk as unlikely and is not shipping an emergency fix, deferring it to the next routine release.
No exploitation of this new vector has been reported. Attacks observed so far target only the earlier PHP2Shell pair, which were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Who is affected
Web applications running PHP that dynamically change the session serialize handler at runtime while leaving session upload progress enabled (the default).
Most applications that never alter the serialize handler at runtime remain unexposed via this path. PHP has not listed specific version ranges for the new issue.
Why it matters
PHP powers a huge share of the web. Even a narrow configuration risk adds pressure right after high-severity unauthenticated RCEs drew mass scanning and attempted Mirai installs.
Operators who already applied the October 21 patches still need to confirm the upload-progress mitigation stays in place, because the new vector is independent.
How it could have been prevented
Set session.upload_progress.enabled=0 in php.ini or via configuration until the next routine PHP release that includes the fix. This single change also covered the earlier CVE-2026-109619 mitigation.
Apply the emergency PHP2Shell patches if not already done, restart workers, and audit any code that calls ini_set() on session.serialize_handler before session_start().
Relevant professional terms
- Remote code execution (RCE)
- A flaw that lets an attacker run their own commands or programs on a target system as if they were a legitimate user or process.
- Session serialize handler
- The PHP setting that controls how session data is encoded and decoded for storage; switching it at runtime under specific conditions can leave memory in an inconsistent state exploitable for code execution.
China Hackers Leveraged AI Agents in ConnectWise Breach
HighWhat happened
Microsoft attributed a breach of ConnectWise’s cloud backup service to the China state-aligned group Storm-0940. The attackers stole application credentials used to link ConnectWise with customer Microsoft-hosted environments.
They then used the open-source AI agent framework ARTEX to automate rapid sign-in attempts against roughly 2,250 organizations at nearly 3,000 attempts per minute, giving defenders little response window. The same framework had previously appeared in attacks on South Korean financial systems.
ConnectWise paused the cloud backup service and is restoring it while investigating.
Who is affected
ConnectWise Cloud Backup customers whose application credentials were stolen, exposing their Microsoft 365 and related environments.
Microsoft reported successful or attempted access across about 2,250 organizations spanning aerospace, defense, energy, finance, government, manufacturing and other sectors.
Why it matters
A single IT-management vendor compromise cascaded into mass customer access via stolen credentials and AI-driven automation. The speed of agentic attacks compresses detection windows to minutes.
Operators relying on third-party backup or remote-access tools face supply-chain risk that can bypass normal MFA once tokens or app credentials are obtained.
How it could have been prevented
Review and rotate any ConnectWise-linked application credentials and OAuth tokens immediately. Enforce phishing-resistant MFA, conditional access, and continuous monitoring for anomalous sign-ins from unexpected IPs or high-velocity attempts.
Limit third-party app permissions to least privilege, audit Entra ID for unexpected devices or credential changes, and pause non-essential backup connectors until the vendor confirms full remediation.
Relevant professional terms
- Supply-chain attack
- An attack that compromises a trusted vendor or service so the attacker can reach many of that vendor’s customers at once.
- Agentic AI framework
- Software that chains large language models into autonomous agents capable of planning and executing multi-step tasks such as reconnaissance, credential spraying and privilege escalation at machine speed.
Arista Patches Actively Exploited VeloCloud Zero-Day
CriticalWhat happened
Arista Networks released patches for CVE-2026-114625, a critical SQL-injection vulnerability (CVSS 9.9) in the VeloCloud Orchestrator (VCO) on-premises web management portal. Authenticated users with basic privileges can escalate to superuser and access privileged internal functions.
Arista confirmed the flaw is actively exploited in the wild. Hosted and Dedicated VCO instances were already patched by the vendor. On-prem fixed releases are 5.2.3.18, 6.1.3.10, 6.4.2.12 and later.
This is the fourth actively exploited zero-day Arista has patched this year affecting its infrastructure.
Who is affected
Organizations running on-premises VeloCloud Orchestrator versions prior to the fixed releases listed above. Arista serves more than 10,000 customers globally; any deployment exposing the management portal is at risk.
Hosted VCO customers are already covered by vendor-side patches.
Why it matters
VCO is the central control plane for SD-WAN environments. Privilege escalation to superuser can compromise the orchestrator host and all managed network data and configurations.
Active exploitation plus repeated zero-days on the same product line raise the priority for immediate patching and network isolation of management interfaces.
How it could have been prevented
Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later immediately. Until then, restrict web-interface access to administrative networks only, monitor logs for suspicious activity, and block traffic from the reported exploitation IPs 74.82.197.86 and 38.54.50.151.
Review recent admin actions and watch for unexpected privilege changes or backdoors.
Relevant professional terms
- Zero-day
- A vulnerability that is exploited in the wild before a patch or public advisory is available, leaving defenders with no ready fix.
- SQL injection
- An attack that inserts malicious SQL statements into an application’s database queries, often allowing data theft, modification or privilege escalation when input is not properly sanitized.
Token-Spraying Hits Microsoft 365 at 79 Organizations
HighWhat happened
Huntress tracked a ten-week campaign (July 14 to September 22, 2026) in which an attacker replayed stolen Microsoft 365 session tokens, achieving 497 successful sign-ins across 79 organizations and more than 200,000 failed attempts.
Tokens were obtained via adversary-in-the-middle phishing pages that relayed real Microsoft login and MFA prompts, device-code phishing, and social engineering. The attacker then bulk-replayed them (“token spraying”) from IPs belonging to 1337 Services GmbH, often within minutes of theft.
Once inside, the actor registered rogue devices, replaced MFA methods, and created hidden inbox rules to delete or bury mail, enabling business-email-compromise activity including payroll-related fraud attempts.
Who is affected
Microsoft 365 / Entra ID users at the 79 organizations observed by Huntress. Any organization whose users can be lured to AiTM or device-code phishing pages is potentially exposed.
The campaign used a rotating set of six addresses in the 193.26.115.0/24 range.
Why it matters
Session tokens issued after MFA let the holder bypass password and MFA checks entirely. Volume replay across many tenants turns individual phishing successes into a scalable campaign.
Persistent rogue devices and MFA swaps survive password resets, turning short-lived token theft into long-term account control and stealthy BEC.
How it could have been prevented
Enforce phishing-resistant MFA (passkeys or hardware keys), Conditional Access policies that block legacy auth and unusual locations, and continuous access evaluation. Monitor Entra ID for new devices named “DESKTOP-” plus hex strings and sudden MFA method changes.
Block or alert on the 193.26.115.0/24 range, audit inbox rules for suspicious names or moves to RSS Feeds/Conversation History, and require re-authentication plus device cleanup after any suspected token theft. Educate users on device-code and AiTM phishing.
Relevant professional terms
- Session token
- A temporary credential issued after a successful login (including MFA) that proves the holder is already authenticated and can access services without re-entering a password.
- Adversary-in-the-middle (AiTM)
- A phishing technique that proxies the real login page so the victim completes MFA while the attacker simultaneously captures the resulting session token.
LiteLLM Hit by Second Supply Chain Attack in 2026
HighWhat happened
Attackers compromised LiteLLM’s release pipeline on October 21 and published malicious version 1.107.0 to PyPI and Docker registries. The build contained credential-stealing malware and remote-code-execution loaders that run on every Python startup via sitecustomize and related hooks.
The package was live on PyPI for roughly two hours (11:39-13:23 UTC) and Docker tags (v1.107.0, latest, main-latest, main-stable) for a similar window. LiteLLM stated the attacker used stolen GitHub CLI OAuth tokens from three engineers, likely obtained from an exposed internal deployment whose logs contained the tokens.
This is the second supply-chain compromise of LiteLLM in 2026. Impacted artifacts have been pulled; the last safe version is 1.106.2. Enterprise private-registry customers were unaffected.
Who is affected
Anyone who installed litellm==1.107.0 from PyPI or pulled the listed Docker tags during the short exposure window. LiteLLM sees about 23 million weekly downloads and commonly sits alongside cloud, AI-provider and database credentials.
Prior March incident data had already linked stolen material to roughly 2,500 organizations.
Why it matters
A poisoned dependency that executes at interpreter start can harvest secrets even if the application never imports the library. AI/LLM tooling often holds high-value API keys and cloud identities, amplifying blast radius.
Repeated compromises of the same project highlight risks in release pipelines and token hygiene for open-source maintainers.
How it could have been prevented
If 1.107.0 or the tainted Docker tags were installed, treat all credentials on that host as compromised: rotate cloud, AI-provider, Git, SSH, browser and LiteLLM proxy secrets immediately. Pin to 1.106.2 or earlier known-good versions and verify package hashes.
Audit Python site-packages for unexpected .pth / sitecustomize.py files, review GitHub token scopes and revoke unused OAuth tokens, and isolate build environments. Prefer private registries or verified mirrors for production.
Relevant professional terms
- Supply-chain attack
- Tampering with a software component, build system or distribution channel so that downstream users receive malicious code when they install or update a trusted package.
- Python startup hook
- Files such as sitecustomize.py or .pth entries that the interpreter automatically executes on every launch, giving malware a persistent foothold independent of the application’s import statements.
Sandworm Deploys New Mesh Backdoor in Ukraine Wiper Attack
HighWhat happened
ESET reported that Russia-aligned UAC-0099 (Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025 via spear-phishing, deployed the MATCHWOK backdoor through the MATCHBOIL downloader, and one day later installed a previously undocumented backdoor named MythicRatatoskr.
MythicRatatoskr communicates with a C2 server inside the Yggdrasil mesh network, supports command execution, file transfer, screenshots, SOCKS5 proxying and other standard backdoor functions, and may have a Linux variant. Access was later handed to Sandworm (GRU Unit 74455), which on September 17, 2025 conducted a destructive wipe using SDelete distributed via Active Directory Group Policy.
ESET assesses this as the first documented abuse of Yggdrasil by a state-aligned actor for C2 resilience and stealth.
Who is affected
The specific Ukrainian grain/logistics firm targeted in 2025. Broader risk applies to Ukrainian government, energy, logistics and grain-sector organizations previously noted as UAC-0099/Sandworm targets.
Any environment where Yggdrasil traffic or the new backdoor family appears should be treated as high priority.
Why it matters
Collaboration between an initial-access specialist and a destructive actor extends dwell time and raises the chance of wiper effects. Experimental peer-to-peer mesh networks complicate traditional C2 detection and takedown.
The use of living-off-the-land tools such as SDelete via GPO shows how legitimate admin channels can finish the attack after stealthy backdoors establish foothold.
How it could have been prevented
Block or closely monitor Yggdrasil-related traffic and unknown mesh protocols. Hunt for MATCHWOK, MATCHBOIL and MythicRatatoskr indicators, unexpected SOCKS5 proxies, and SDelete or similar wiping utilities pushed by Group Policy.
Harden email gateways against spear-phishing, enforce least-privilege and application allow-listing, segment critical systems, and maintain offline or immutable backups tested for rapid recovery from wiper events.
Relevant professional terms
- Backdoor
- Malware that gives an attacker remote, persistent access to a compromised system so they can issue commands, steal data or move laterally.
- Mesh network C2
- Command-and-control traffic routed through a decentralized peer-to-peer overlay (here Yggdrasil) instead of a classic central server, improving resilience and reducing easy sinkholing.
Black October: AI Amplifies PHP and Other Major Hacks
HighWhat to watch
- Volume and quality of AI-generated exploits versus working ones
- Patch latency for core runtimes (PHP, Node, etc.) and cascading dependency impact
- Secondary exploitation waves against unpatched or EOL systems
- Defensive use of the same AI tooling for detection and rapid triage
- Government and vendor emergency guidance cadence
What happened
Security researchers and operators have labeled the cluster of late-October 2026 disclosures and attacks “Black October.” The centerpiece is the PHP2Shell pair of critical flaws (discovered with heavy AI assistance by Wiz and others), which saw exploit attempts scale from thousands to millions within hours of public disclosure according to Cloudflare.
The same period brought issues or incidents affecting eMudhra certificate infrastructure, Node.js, GitLab, Plex, Railway, OpenCode and multiple other widely used services, alongside AI-accelerated offensive campaigns. Experts ranging from cryptographers to vendor CEOs describe a step-change in both vulnerability discovery speed and attack automation.
Rhetoric has ranged from measured warnings to calls for immediate hardening; some AI-generated exploit code circulating online has proven non-functional, yet skilled operators are clearly benefiting from the tools.
Who is affected
Any organization running internet-facing PHP, Node.js, GitLab, media servers, cloud platforms or certificate-dependent services, plus defenders trying to keep pace with disclosure volume.
Broader internet users face elevated risk from mass scanning and opportunistic secondary exploitation.
Why it matters
AI lowers the skill and time barriers for finding complex bugs and for scaling post-exploitation. When core runtime languages and popular platforms ship critical flaws in rapid succession, patch windows shrink and defensive capacity is stretched.
Operators can no longer assume that obscure or hard-to-reach bugs will stay theoretical; automation turns them into immediate operational threats.
Relevant professional terms
- Vulnerability disclosure
- The process of publicly or privately revealing a security flaw so that vendors and users can prepare patches and mitigations before widespread abuse.
- AI-assisted vulnerability research
- The use of large language models and autonomous agents to accelerate reverse engineering, fuzzing, root-cause analysis and exploit development far beyond purely manual human effort.