Article Read Time
Top 5 Cyber Security News Stories
1. PHP2Shell: Two Critical PHP Flaws Under Active Exploitation Two CVSS 9.2 vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP core allow pre-authentication remote code execution across every PHP 7.x and 8.x release, regardless of CMS or framework. Exploit attempts began before public disclosure, forcing the PHP Foundation to move its release up a day, and agencies including CISA and NCSC urged immediate patching or taking affected systems offline. Researchers estimate roughly 2.6 million internet-facing hosts run PHP.
Source: The Hacker News | https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
2. LiteLLM Supply Chain Attack Targets Cloud and AI Credentials A malicious LiteLLM 1.107.0 release was published to PyPI, Docker Hub, and GHCR, installing a credential stealer that harvests cloud keys, AI provider API keys, SSH keys, and browser data. Wiz observed attackers using stolen AWS role credentials about 4.5 hours after exfiltration. Users should roll back to v1.106.2, rebuild affected images, and rotate every secret on exposed hosts.
Source: Wiz Blog | https://www.wiz.io/blog/litellm-compromised-steals-credentials
3. eMudhra Intermediate CA Keys Were Trivially Recoverable, Browsers Revoke Trust Private keys for eight eMudhra intermediate certificates were weak enough to be recovered from the public certificates in under a second, which would have allowed anyone to forge HTTPS certificates. Apple, Google, Microsoft, and Mozilla moved to block the certificates, and eMudhra later announced it will exit the global SSL/TLS certificate business. It remains unknown whether the weak keys were abused during the 17 months before discovery.
Source: Help Net Security | https://www.helpnetsecurity.com/?p=388647
4. Campaign Hits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials Group-IB and NyxLab detailed a large campaign by an actor tracked as k0t, which exploited FortiGate, FortiWeb, and PAN-OS flaws (CVE-2025-64446 and CVE-2026-0257) and brute-forced logins to gain VPN access. The actor is assessed to have ties to the Qilin and The Gentlemen ransomware groups, and data was exfiltrated with Rclone to cloud storage. Defenders should patch edge devices, rotate VPN and directory credentials, and hunt for the remote access tools named in the report.
Source: The Hacker News | https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
5. PingCAP Confirms TiDB Cloud Internal Data Exposure From Stolen Credentials PingCAP disclosed that an unauthorized party used stolen service account credentials between September 9 and October 7 to copy internal data and source code. Exported records included TiDB Cloud account details, customer contacts, billing data, and a table of encrypted API-key values. PingCAP reports no evidence that data stored in TiDB itself was affected and says it will notify impacted customers directly.
Source: PingCAP Trust Hub | https://www.pingcap.com/trust-hub/security/security-update-october-2026/