Researchers at Dr.Web uncovered malicious GitHub projects disguised as security scanners, log-analysis utilities and other technical tools.

The campaign installs malware including AsyncRAT, information stealers and clipboard hijackers that can replace copied cryptocurrency wallet addresses. Researchers report more than 2,000 compromised Windows systems.

Some malicious code was hidden in build scripts and source files, meaning users could become infected while attempting to compile or run supposedly legitimate tools.

A GitHub repository is not automatically trustworthy because its code is publicly visible. Downloading unfamiliar security utilities can itself become an attack vector.

Sekoia researchers documented a watering-hole campaign in which compromised legitimate websites and convincing imitation portals delivered device-specific exploit chains. Some attacks could run without additional user interaction after a vulnerable device visited a malicious page.

The campaign targeted known vulnerabilities in iOS and Chrome for Android, potentially exposing browser cookies, credentials, messages, and other sensitive information. Researchers attributed the activity to APT29 with moderate-to-high confidence.

Even a legitimate website can become dangerous if compromised. Apple and Google have patched the vulnerabilities identified in this campaign, making updates especially important.

Researcher Ozgun Kultekin disclosed a vulnerability nicknamed sshole that can allow unauthorized SSH logins to certain accounts whose password authentication was deliberately disabled.

The flaw affects specific configurations of musl-based Linux systems, including Alpine Linux, OpenWrt and Buildroot. It requires several conditions, including enabled SSH password authentication and particular account password-hash settings.

Administrators may believe an account cannot accept password logins when the vulnerable configuration actually permits them. OpenSSH 10.6p2 fixes the issue. Standard glibc-based distributions such as Ubuntu and Debian are not affected by this specific flaw.

Attackers distribute a malicious updater that replaces CWP's legitimate cwpsrv web-server binary with a trojanized version. The backdoor remains dormant until attackers activate it through specially crafted HTTP requests containing encrypted commands.

What makes this particularly dangerous is its stealth. CWPdoor suppresses logging of malicious requests, restores file timestamps, deletes evidence of installation, and encrypts communications to make detection more difficult.

Researchers identified evidence suggesting real-world infections, although the number of compromised servers remains unknown. More than 340,000 CWP instances were observed exposed to the internet, but that does not mean 340,000 servers were infected.

Compromised hosting control panels can give attackers access to websites, databases, email services and potentially other hosted infrastructure.

Administrators should check for suspicious cwpsrv processes, the ngx_http_integrity_helper socket, and X-Ngx-Integrity strings in the server binary. Confirmed compromises require replacing the malicious binary, updating the software, rotating credentials and investigating for additional malware.

CISA added CVE-2026-119977 (CVSS 8.1) to its Known Exploited Vulnerabilities catalog on November 3. Attackers can exploit a race condition involving temporary update directories to execute malicious code during WordPress core upgrades. Versions 4.7 through 7.1.3 are affected; version 7.1.4 contains the fix.

Website administrators should update promptly, using trusted vendor guidance, and check for signs of compromise. The flaw is especially dangerous because it can be exploited without authentication under the vulnerable update conditions.

CISA recognizes active exploitation. That does not mean every vulnerable WordPress site has been compromised.

https://www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/

Britain's National Cyber Security Centre warns that AI-enabled malware is highly likely to be used in ransomware attacks against critical infrastructure by 2028. AI could make existing attacks faster and easier to scale.

Organizations need to strengthen patching, administrator access controls, monitoring and backups rather than relying on defenses against traditional malware alone.

The NCSC warning. This is a forward-looking threat assessment, not confirmation that a particular AI-powered infrastructure attack has occurred.

Drupal's security team warned that attackers are actively exploiting CVE-2026-118539, an access-bypass vulnerability in the Commerce Core module.

Insufficient protection of routes and entity fields could allow unauthorized changes with financial consequences for merchants.

E-commerce operators may face fraudulent or inconsistent orders. Applying a patch alone may not reveal changes attackers already made.

Upgrade Commerce Core 3.x to 3.3.13 or the older supported branch to 8.x-2.41, then audit orders for inconsistencies.

Drupal explicitly identifies exploitation in the wild. The advisory does not establish how many stores have been compromised.

CISA added CVE-2026-111497, a Brotli decompression memory-corruption vulnerability, to its Known Exploited Vulnerabilities catalog. It can potentially enable information disclosure, crashes, or remote code execution in affected applications.

Node.js, .NET, and other software using vulnerable Brotli decoders may be exposed when processing attacker-controlled compressed data.

Apply relevant patches and redeploy affected applications or containers. CISA's listing confirms exploitation, but doesn't establish widespread successful production compromises.

Tailscale released version 1.104.4 after researchers demonstrated privilege-escalation vulnerabilities in Tailscale SSH.

An attacker with access to an already-authorized device could potentially gain elevated privileges on reachable systems.

A compromised machine could become a stepping stone into other servers permitted by SSH policy. This is not an unauthenticated Internet-wide worm.

Update Tailscale SSH systems and review SSH access permissions.

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies have been directed to remediate the vulnerabilities by October 29.

There is an important correction to earlier reporting. Palo Alto Networks Unit 42 retracted its claim that PHP2Shell caused a European government agency compromise.

Researchers confirmed that an attack occurred against a vulnerable PHP application, but could not establish that either PHP2Shell CVE provided initial access.

This directly relates to our discussion yesterday about honeypots versus production compromises. CISA recognizes active exploitation, but the specific government intrusion should not be presented as confirmed PHP2Shell exploitation.

There is an important development in the PHP2Shell story we've been discussing.

Until recently, researchers had observed scanning and exploitation attempts, but convincing evidence of successful attacks was limited. That changed today.

Security researcher Adel Karimi reported evidence from honeypots showing successful exploitation against an Apache installation running PHP 8.4.26.

The evidence included memory disclosure followed by remote command execution.

Security researcher Marcus Hutchins independently reviewed the findings and described them as particularly convincing evidence of real-world exploitation.

The affected vulnerabilities are:

CVE-2026-109618 and CVE-2026-109619.

These are the same vulnerabilities addressed by the October 21 PHP security updates.

This is more significant than Google's earlier reminder to restart services after patching.

Researchers now have evidence that attackers can successfully execute commands against vulnerable PHP installations.

For administrators operating web applications or onion services using PHP, that raises the urgency of patching and checking for compromise.

The finding confirms successful exploitation against a honeypot. It does not establish how many production servers have been compromised.

Recommended action: Install the appropriate patched PHP release, ensure the patched runtime is actually running, and review suspicious requests and server activity.

Update the existing PHP2Shell announcement to distinguish confirmed successful exploitation from the earlier unsuccessful attempts.

Google cloud updated its PHP2Shell security advisory on October 23 with additional guidance from Mandiant Consulting.

CVE-2026-109618 and CVE-2026-109619

Both are critical remote-code-execution vulnerabilities affecting PHP.

The updated guidance emphasizes that installing patched packages does not necessarily mean the running web application is protected.

Older PHP processes may remain active in memory until the relevant web-serving services are restarted.

Researchers also recommend preserving volatile forensic evidence before restarting servers suspected of compromise.

Google additionally announced new detection capabilities for identifying potentially vulnerable systems and suspicious activity.

Why onion-service administrators should care

An onion service running PHP can remain vulnerable even when Tor successfully hides its hosting infrastructure.

Administrators should verify that the web server actually uses a patched PHP runtime.

For supported upstream branches, the initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Distribution-specific security backports may use different version numbers.

Review logs dating back to October 17, when Amazon Threat Intelligence observed early exploitation attempts.

Confirmed exploitation attempts do not automatically establish successful server compromise.

Recommended action: Patch, restart the appropriate services, verify the running version, and investigate suspicious activity. Preserve evidence first if compromise is suspected.

New technical findings make the PHP2Shell situation more serious than the original patch announcement alone suggested.

Amazon Threat Intelligence identified attempted exploitation dating to October 17, four days before the vulnerabilities were publicly disclosed.

The vulnerabilities are:

CVE-2026-109618 and CVE-2026-109619

Both carry critical CVSS v4.0 scores of 9.2.

Amazon observed additional attempts before the public release, followed by widespread exploitation attempts after the October 21 disclosure.

Researchers have not established that every observed attempt successfully compromised a real-world server.

Why onion-service administrators should care An onion service running vulnerable PHP may be exposed even when its real server IP address remains hidden.

Tor protects the network path; it does not fix vulnerabilities in the application running behind it.

Upgrade to patched PHP releases, including 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as appropriate. Review server logs dating back to at least October 17.

Web application firewalls may reduce exposure but do not replace patching. Update the existing PHP security advisory to mention confirmed exploitation attempts and the earlier October 17 activity.

October 12–13 | Cybersecurity | CRITICAL

GitLab released security updates addressing CVE-2026-97229, a vulnerability with the maximum CVSS severity score of 10.0.

The vulnerability affects GitLab's CI/CD regular-expression compiler.

Under certain conditions, an unauthenticated attacker could submit specially crafted configuration data that results in arbitrary code execution on a vulnerable GitLab server.

The issue affects self-managed Community Edition and Enterprise Edition installations.

GitLab released fixes for the affected version branches and strongly recommends immediate upgrades.

GitLab's hosted service has already been patched.

Researchers have not established widespread exploitation of this vulnerability in the wild.

Status: CONFIRMED — Vendor security advisory and published technical reporting.