IT News Analysis

1

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab. The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. The cybercriminal actor was first seen in the wild on October 22, 2025. The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. Analysis of the threat actor's dark web activity reveals a k...

Oct 23, 2026

2

What the FBI Wants From Private-Sector Defenders, Straight From the Source

Hear the FBI's Brett Leatherman with SANS CEO James Lyne 12/15 at SANS CDI 2026, a week of hands-on training.

3

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560 , affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release. The warning came in a short  informational advisory  published on October 23. It follows the October 21  emergency release  that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 , which let an attacker without an account run code on a server. Those were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new issue is separate and is not fixed by those releases. Only a narrow setup is at risk. PHP says the problem can occur when a web application does all of the followi...

Oct 23, 2026

4

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET , the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL. The activity ultimately culminated with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold. What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed. There are indications that development on the backdoo...

Oct 23, 2026

5

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow , the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw,  CVE-2026-112900 , is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript , a separate program it runs to turn the image into pixels, without checking the name first. Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in  version 13.0.0 , released on October 16. Pillow turns up almost everywhere Python handles images: web upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects pull it in. OX Security, the firm whose report drew attention to the flaws, estimates the library is downloaded  about 436 million times a month . Version 13.0.0 is a large security release, with fixes...

Oct 23, 2026

6

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their " Node2Shell " proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder ( CVE-2026-111497 ). Node.js disclosed the flaw and  released fixes on October 21 , and applications that decode untrusted Brotli data should update. Imperva's test did not succeed on every attempt, and code execution took several tries in its Linux arm64 setup. The result covers that one build and application setup, with other architectures and the 22.x and 26.x lines not tested. On the fixed release, 24.22.1, the same data was rejected, and no code ran. The demonstration goes beyond the  first public proof of concept , which achieved code execution only on a deliberately weakened test build. On a standard build, that proo...

Oct 23, 2026

7

Gartner® Hype Cycle™ for CPS Security, 2026

Prioritize cyber-physical systems security amid rising threats, regulations, vulnerabilities and emerging technologies.

8

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents paying for API calls with the  x402 SDKs  could sign a payment for their full balance of a supported token if a malicious API asked for it,  security firm V12 said  on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set no limits. The missing limit is one of 25 flaws V12 found in the x402 code, and one of three it rated critical and described in detail. The x402 Foundation, which maintains the SDKs, had already fixed all three critical flaws in the August 18 releases. One of the other two let a facilitator, the service that checks x402 payments, accept a Solana transaction that moved no tokens as a valid payment. Among the x402 SDKs, only the TypeScript one had this flaw. The other let a malicious server get an agent to sign a login message for a different website. V12 found the flaws by reviewing t...

Oct 23, 2026

9

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium , as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said . "The sample displays downloader and network disruption functionality." ⚡ WARNING — PHP Warns of Another Unpatched RCE Flaw CVE-2026-115560 Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connec...

Oct 23, 2026

10

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool? Most of the conversation about AI security is about what threat actors are doing with it. But the bigger threat may already be inside your organization.

Oct 22, 2026