Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
28 / 1870 results
criticalbug_reportVulnerabilityGitLab patches max severity RCE flaw in Regular Expression Compiler
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264. Over 2,700 GitLab CE instances exposed online.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
highbug_reportVulnerabilityOpenCode AI agent flaw allows MCP server code execution on Windows/WSL
OpenCode AI coding agent versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux (WSL). macOS and Linux are not affected. Fixed in version 1.18.33 released September 28, 2024.
criticalbug_reportVulnerabilityLiteLLM supply chain attack: malicious v1.107.0 steals credentials via PyPI
LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC).
highbug_reportVulnerabilityOperation Serengeti III disrupts 10,909 networks, arrests 1,462 in Africa
Cybercriminal infrastructure across 21 African countries, including business email compromise operations, ransomware networks, phishing infrastructure, fraudulent mobile lending apps, illegal cryptocurrency mining operations, and online investment sc…
highpublicGeopoliticalJapanese VPS Provider Onamae Desktop Cloud Breached, 27,000 Servers Hit
The compromise of Onamae Desktop Cloud, operated by GMO Internet Group—one of Japan's largest domain registrars and internet infrastructure providers—represents a significant supply-chain style attack on Japan's digital economy.
highperson_alertThreat ActorLazarus deploys post-quantum cryptography in FlashHole campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor with a long operational history spanning financial cybercrime, espionage, and destructive attacks.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 RCE affects all self-managed versions since 2014
GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched.
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack delivers credential stealer via PyPI
LiteLLM Python package version 1.107.0 distributed via PyPI wheels (all platforms: macOS x86_64/ARM64, Linux x86_64/aarch64, Windows AMD64) and Docker images. Compromised through stolen GitHub CLI OAuth tokens from three engineer accounts.
criticalbug_reportVulnerabilityCritical RCE flaws in PHP affect 22.6M+ exposed instances globally
PHP (all widely-deployed versions; specific affected versions not disclosed in advisory). Over 22.6 million exposed instances identified via Cortex Xpanse telemetry. Affects web servers and content management systems globally.
criticalbug_reportVulnerabilityCritical PHP RCE flaws affect 70% of websites, active exploitation
PHP versions 5.4 and later (all versions released in the last decade). Affects approximately 2.58 million Internet-facing hosts and 54.9 million web properties. Impacts sites running Drupal, Magento, Joomla, WordPress, and other PHP-based platforms.
criticalbug_reportVulnerabilityPHP releases emergency patches for PHP2Shell RCE flaws in all versions
All PHP installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Highest risk for mod_php deployments. Affects PHP 8.x (fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35) and all PHP 7.x and earlier (minimal backports av…
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
highbug_reportVulnerabilityClickFix attacks surge via fake AI installers and malicious search ads
Organizations using AI tools (Claude, ChatGPT, Codex, NotebookLM). All platforms (Windows, macOS). Users accessing AI tools via search engines or shared chatbot links. ClickFix now represents 52-67% of browser-based attacks detected in Q2-Q3 2026.
criticalbug_reportVulnerabilityPHP releases emergency patches for critical PHP2Shell RCE flaws
All PHP installations serving web requests: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all versions back to PHP 5.4.
highperson_alertThreat ActorBronze Sandcastle Uses Sandboxie DLL Sideloading for Espionage
Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa.
criticalbug_reportVulnerabilityCritical PHP RCE flaws (CVE-2026-109618/109619) affect all versions
All versions of PHP are affected. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution via out-of-memory conditions causing memory corruption. Third-party products and appliances bundling PHP are also impacted.
criticalbug_reportVulnerabilityPHP2Shell RCE flaws (9.2/10) patch due Oct 21 14:00 UTC, no workaround
PHP versions 8.2 through 8.5 (exact affected versions to be disclosed with patch). All internet-facing PHP deployments are at risk. PHP-FPM, mod_php, and CGI/FastCGI runtimes are affected.
highbug_reportVulnerabilityAttackers hijacked 300+ Tor exit relays to intercept SSH credentials
Over 300 Tor exit relays compromised October 1-5, 2026. Affected users who connected to SSH servers via Tor during this window, accepted unfamiliar host keys, and used password authentication. Attack peaked at 7.46% of Tor's total exit capacity.
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
criticalbug_reportVulnerabilityeMudhra CA issued 8 certificates with instantly crackable private keys
eMudhra intermediate certificates issued April 2025 using P-384 keys with values <256. Affects systems using Mozilla NSS, Go (pre-1.27.3/1.26.10), Python certifi, Rust webpki, Electron, and other software with embedded certificate stores.
criticalbug_reportVulnerabilityTwo critical RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) patched Oct 21
All PHP versions from PHP 5 onwards. CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. Unauthenticated remote code execution possible. Patches scheduled for 21 October 2026 at 14:00 UTC.
criticalbug_reportVulnerabilityPHP emergency patches for two critical RCE flaws due Oct 21, 14:00 UTC
PHP versions 5, 6, 7, and 8 (all major versions). CVE-2026-109618 and CVE-2026-109619. Affects websites, CMS platforms, e-commerce systems, and custom web applications running PHP.
highbug_reportVulnerabilityMultiple high severity vulnerabilities in Apache Camel require patching
Apache Camel - specific versions not provided in advisory. All deployments using affected versions should be considered at risk pending detailed vendor bulletin review.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; fraudulent certs possible
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Affects browsers (Chrome, Firefox, Safari), Go 1.26.x/1.27.x, Python certifi, Rust webpki-roots, NSS, and any software using eMudhra-issued certificates.