Daily Cybersecurity News – October 24, 2026
CyberRecaps is supported by its readers. We may earn an affiliate commission at no extra cost to you if you buy through a link on this page.
PHP Warns of Second Unpatched RCE After PHP2Shell
MediumWhat happened
Two days after emergency patches for the critical PHP2Shell flaws, PHP issued an informational advisory about another remote code execution path tied to session upload progress.
The issue requires an unusual combination: the session.serialize_handler set to php_binary or php_serialize, then switched at runtime via ini_set() to php before session_start(), while session upload progress remains enabled. It is not fixed by the October 21 releases that addressed CVE-2026-109618 and CVE-2026-109619.
No exploitation of this new path has been reported. Earlier PHP2Shell attacks surged quickly after disclosure but have not produced confirmed successful code execution in the wild.
Who is affected
Web applications running PHP that dynamically change the session serialize handler at runtime while leaving session.upload_progress.enabled on (the default). Most applications that never alter the handler at runtime are not exposed via this path.
PHP has not listed specific affected versions. The prior PHP2Shell fixes landed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why it matters
Unauthenticated RCE in PHP remains high-impact because the language powers a large share of the web. Even a narrow configuration path keeps pressure on operators who already scrambled to patch the first two flaws.
Attackers have already shown interest in the PHP2Shell class, with millions of probes and attempts to drop Mirai variants shortly after the initial disclosure.
How it could have been prevented
Set session.upload_progress.enabled=0 in php.ini, an FPM pool, or server config until the next routine release that includes the fix. Do not rely on late ini_set() or .user.ini changes.
Anyone who already applied this mitigation for the earlier PHP2Shell issues can leave it in place. Also ensure the emergency patches for CVE-2026-109618 and CVE-2026-109619 are installed.
Relevant professional terms
- Remote code execution (RCE)
- A flaw that lets an attacker run their own commands or programs on a target system, often without logging in.
- Session serialize handler
- The PHP setting that controls how session data is encoded and decoded when written to or read from storage; switching it at runtime can create type-confusion or injection paths.
LiteLLM Supply Chain Attack Uses Python Startup Hooks
HighWhat happened
On October 21, 2026 a compromised LiteLLM 1.107.0 release was published to PyPI and official Docker tags. The malicious wheels planted files that execute during normal Python interpreter startup, so the payload can run even if an application never imports LiteLLM.
Microsoft analysis identified a credential collector triggered via a .pth path extension and a Unix-oriented loader via sitecustomize.py. The collector targeted browser passwords and cookies, SSH keys, cloud credentials (AWS, Azure, GCP), Kubernetes, Docker, GitHub CLI tokens, and other secrets, then exfiltrated them. A secondary module could pull remote code.
The package was live on PyPI for roughly two hours and on Docker tags slightly longer before removal. The compromise stemmed from stolen developer credentials that redirected the release workflow to a lookalike repository.
Who is affected
Anyone who installed litellm==1.107.0 from PyPI or pulled the affected Docker tags (v1.107.0, latest, main-latest, main-stable) during the short window on October 21. Developer workstations, CI runners, and production environments that started Python afterward are at risk.
LiteLLM is widely used as a proxy and SDK for multiple LLM providers, so the blast radius includes AI application stacks and their credential stores.
Why it matters
Supply-chain compromises that hook Python startup bypass normal import-based detection and can steal high-value cloud, code-hosting, and AI credentials in bulk. Once secrets are taken, attackers can move laterally into repositories, cloud accounts, and production systems.
The short window still mattered because automated installs and unpinned dependencies can pull the latest version instantly.
How it could have been prevented
Check environments with pip show litellm or equivalent; if 1.107.0 is present, treat the environment as compromised. Rotate all potentially exposed credentials (cloud keys, GitHub tokens, SSH keys, browser-stored secrets). Pin to known-good versions and avoid unpinned installs.
Do not start Python or pip inside a suspect environment for investigation. Rebuild from clean base images, enable package integrity checks, and monitor for the known malicious files (cook.pth, cook.py, sitecustomize.py). Review Defender or EDR detections for the collector behavior.
Relevant professional terms
- Supply chain attack
- An attack that compromises a trusted software component or its distribution channel so that users who install or update it receive malware.
- Python startup hooks
- Mechanisms such as .pth files and sitecustomize.py that the Python interpreter automatically executes during initialization, before most application code runs.
AI Tools Expose Decades-Old PHP Vulnerabilities
HighWhat happened
Security researchers used frontier AI models to turn long-known but previously impractical PHP flaws into working remote code execution exploits, now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
Calif researchers first identified practical paths in early August with AI assistance under OpenAI’s Patch the Planet program. Wiz and OpenAI teams later independently rediscovered the issues using models such as Gemini and GPT variants. Some underlying problems had been noted as early as 2024 but were considered too complex for reliable human exploitation at the time.
Emergency patches shipped on October 21. Exploitation attempts exploded within hours of disclosure, reaching millions according to Cloudflare, yet confirmed successful takeovers remain unreported so far.
Who is affected
PHP installations dating back many years (core engine issues affecting a large fraction of websites worldwide). Unpatched servers running versions prior to the October 21 emergency releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) are exposed.
Any organization running PHP-backed web applications, especially those with session upload progress enabled by default.
Why it matters
AI lowers the skill and time barrier to turn theoretical or complex bugs into reliable exploits. Flaws that sat unexploited for years can suddenly become mass-scanning targets once models help reverse-engineer them.
This compresses the window between discovery and weaponization and increases pressure on under-resourced teams already facing record vulnerability volumes.
How it could have been prevented
Apply the emergency PHP patches immediately. As a temporary control set session.upload_progress.enabled=0. Monitor for scanning and exploit attempts against PHP endpoints.
Inventory PHP versions across estates, prioritize internet-facing instances, and treat AI-assisted exploit development as a new baseline for patch urgency on foundational open-source components.
Relevant professional terms
- Vulnerability disclosure
- The process of privately reporting a security flaw to the vendor so a fix can be prepared before public details enable attackers.
- Exploit development
- The specialized work of turning a software bug into reliable, weaponized code that achieves a concrete attacker goal such as remote code execution.
Token Replay Compromises Microsoft 365 at 79 Orgs
HighWhat happened
Huntress tracked a ten-week campaign (July 14 to September 22, 2026) in which an attacker replayed stolen Microsoft 365 session tokens to access accounts at 79 organizations. Researchers counted 497 successful sign-ins and more than 200,000 failed attempts.
Tokens were obtained via adversary-in-the-middle relays that passed real Microsoft login and MFA pages to victims, device-code phishing, and social engineering. Because the token is issued after MFA, replay bypasses further MFA. Activity originated mainly from a block of IPs belonging to German hoster 1337 Services GmbH.
Once inside, the attacker registered rogue devices (at least 48 named DESKTOP- plus hex), replaced MFA methods in 19 organizations, and created hidden inbox rules to conceal mail. In at least one case a compromised mailbox was used for a payroll-themed external email.
Who is affected
Microsoft 365 / Entra ID users at the 79 organizations Huntress observed, plus any others targeted by the same infrastructure. Any tenant without strong Conditional Access, device compliance, or token-binding controls is potentially exposed to similar token-replay techniques.
Business email and identity administrators are the primary operators who must respond.
Why it matters
Session-token theft and replay defeats password + MFA defenses that many organizations still treat as sufficient. Persistent footholds via rogue devices and attacker-controlled authenticators survive password resets unless explicitly cleaned.
Hidden inbox rules enable stealthy business email compromise, payroll fraud, and further internal phishing while victims remain unaware.
How it could have been prevented
Enforce Conditional Access policies that evaluate device compliance, location, and risk; prefer token protection / binding where available. Hunt Entra sign-in logs for anomalous OAuth token requests, unfamiliar client IDs, and the known campaign IP range.
After any suspected compromise, audit and remove unknown devices and MFA methods, delete suspicious inbox rules, reset sessions, and require re-registration of authenticators. Block or alert on the observed hosting ASN and rotate any exposed secrets.
Relevant professional terms
- Multifactor authentication (MFA)
- A login check that requires something extra beyond a password, such as a code from an app or a hardware key.
- Adversary-in-the-middle (AiTM)
- An attack that sits between the user and the real login service, proxying the genuine pages so it can capture the post-authentication session token.
Ransomware Affiliates Run AI Agents for Intrusions
CriticalWhat it means
- Edge devices first: Unpatched Fortinet, SimpleHelp, cPanel and VPN gateways remain the preferred initial-access vector.
- Human-approved AI: Models execute the bulk of commands while operators rewrite refused prompts as “authorized red team” work.
- Credential reuse multiplies damage: One reused password unlocked VPN, servers, RMM and backup platforms in a documented case.
- Action: Prioritize KEV edge CVEs, unique credentials, and rapid isolation of any compromised remote-access host.
What happened
SOCRadar uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. Central to it is Phantom, an Autonomous Red Team Kill Chain Framework that executes steps via OpenCode and commercial models hosted on OpenRouter, with a human operator supplying victim-specific prompts and approving actions.
Exposed infrastructure (including a directory at 45.227.254.43) contained 8,257 messages across 133 sessions, victim tracking knowledge bases, stolen credentials, custom encryptors, and tooling. Initial access targeted edge and remote-access systems at scale, exploiting known flaws including CVE-2024-57727 (SimpleHelp), CVE-2026-35616 (FortiClient EMS), CVE-2026-41940 (cPanel/WHM), and others staged or under development.
After entry the operators enumerated domains, escalated privileges, harvested credentials, prioritized sensitive files, exfiltrated data over reverse-SOCKS tunnels, impaired security tools, and prepared ransomware deployment. Credential reuse was a major force multiplier.
Who is affected
Organizations running vulnerable edge devices and remote-access software (FortiClient EMS, SimpleHelp, cPanel/WHM, VPN gateways, SonicWall SMA, certain WordPress/Drupal/LiteLLM setups). Manufacturing, industrial, healthcare and other sectors appear among named targets.
Any enterprise with internet-facing management interfaces and weak credential hygiene is in scope for similar AI-accelerated affiliate operations.
Why it matters
AI agents compress the time and skill needed to run full intrusion-to-ransomware kill chains while humans retain approval control. Exposed logs show real operational use, not just theory, including tailored encryptors and multi-victim tracking.
This raises the tempo and volume of ransomware activity and forces defenders to assume faster post-exploitation once an edge device is breached.
How it could have been prevented
Patch and harden the actively exploited edge CVEs immediately (SimpleHelp path traversal, FortiClient EMS auth bypass, cPanel auth bypass, and related KEV items). Disable or tightly restrict unnecessary remote-access and management interfaces; enforce unique, monitored credentials and MFA everywhere.
Deploy EDR with strong anti-tamper, monitor for reverse-SOCKS and unusual lateral movement, maintain offline or immutable backups, and segment critical finance/HR/legal data. Hunt for the listed infrastructure indicators and review AI/LLM usage policies that could be abused in red-team style tooling.
Relevant professional terms
- Ransomware affiliate
- A criminal partner who breaks into networks and deploys ransomware on behalf of a larger ransomware-as-a-service brand in exchange for a share of the ransom.
- Kill chain
- The sequenced stages of an attack from initial access through privilege escalation, lateral movement, data theft and final impact such as encryption.
Capcom Breach Exposes 11.7 Million Account Records
HighWhat happened
Capcom disclosed that a third party gained unauthorized access to CAPCOM ID customer information. Suspicious activity was detected and confirmed on October 19, 2026.
Attackers obtained 11,774,247 records containing email addresses plus account system data (creation time, last login, login count, most recent sign-in IP). For 43 records the data also included date of birth, gender, country/region and nickname. Passwords originally set by customers were not confirmed compromised, but attackers changed passwords on 196 accounts (since reset by Capcom). Payment card data was not affected.
Capcom blocked the access, stood up incident response, notified Japanese authorities, and states it has addressed the attack method. No group has claimed responsibility. Services remain available.
Who is affected
Anyone with a CAPCOM ID used for Capcom web services and online play across titles such as Resident Evil, Street Fighter, Monster Hunter and others. The 11.7 million records are worldwide; a small subset carried extra personal fields.
Players should treat any Capcom-themed email with heightened suspicion.
Why it matters
Large email dumps enable highly targeted phishing and account-takeover attempts that impersonate Capcom or related services. Even without passwords, the combination of emails, login history and IPs helps attackers craft convincing lures.
Unauthorized password changes on a subset of accounts show the attackers achieved some level of account control during the intrusion.
How it could have been prevented
Watch for phishing emails or messages claiming to be from Capcom; do not click links or open attachments. Change your CAPCOM ID password if you have not already, enable any available two-factor authentication, and review account activity.
Capcom has opened regional support channels. Monitor credit and gaming-related accounts for secondary abuse, and treat unsolicited password-reset or verification requests as hostile.
Relevant professional terms
- Data breach
- An incident in which protected or confidential information is accessed, copied or stolen by an unauthorized party.
- Account takeover
- When an attacker gains control of a legitimate user account, often to steal further data, send fraud, or move deeper into connected services.