cyber.hendryadrian.com
← Cyber Reports

Cyber Threat Weekly Report

2026-W43
Reporting period
2026-10-19 – 2026-10-25 (UTC)
Publication date
Eligible Articles
87
Distinct Publishers
44

Highlighted News

The week's leading stories
Vulnerability

PHP2Shell flaws face exploitation attempts, including before disclosure

Datadog reproduced unauthenticated command execution through CVE-2026-109618 and CVE-2026-109619 during PHP request cleanup. AWS reported exploitation attempts before disclosure, and Arctic Wolf observed widespread scanning and command-execution checks. Request telemetry did not confirm successful exploitation at scale. Fixed PHP releases are available.

Security Significance: The flaws affect multiple PHP deployment types and can permit remote code execution before application code runs. Patching is the only complete remedy identified in the research.

Incident

Gheist uses stolen GitHub tokens to expose repository secrets

Wiz recovered more than 13,500 attacker-planted branches across over 850 accounts in an ongoing campaign. Gheist used compromised tokens to plant workflows that encoded secrets to bypass log masking, retrieved the logs, and quickly deleted runs. Public runs checked by Wiz were held for approval, but private and GitHub Enterprise Server runs executed.

Security Significance: Executed workflows can expose repository and deployment-environment secrets, creating opportunities for further compromise. The branch and account counts do not establish how many secrets were stolen.

Weekly News Digest

Additional developments
  1. Incident

    NetScaler intrusion chained two flaws for root execution and persistence

    Rapid7 traced an intrusion chaining CVE-2026-88771, a pre-authentication log-poisoning and RCE issue, with CVE-2026-88779, a SAML-parsing crash flaw. Attackers installed cookie-authenticated PHP web shells and maintained access through cron jobs, boot hooks, watchdogs and high-availability synchronization.

    Security Significance: The investigation connects exploitation to root payload execution, internal mapping and configuration-data exfiltration, giving defenders concrete persistence mechanisms to investigate.

  2. Incident

    Microsoft 365 token-replay campaign affected 79 organizations

    Huntress observed at least 497 successful sign-ins across 79 organizations during a 10-week campaign. Attackers acquired sessions through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed tokens, registered rogue devices, changed MFA and hid emails.

    Security Significance: Stolen sessions enabled access and account changes across many organizations. The use of rotating infrastructure and two replay toolsets makes single-IP blocking insufficient.

  3. Incident

    Malicious LiteLLM release uses Python startup hooks to steal credentials

    Socket found credential-stealing startup hooks in all seven LiteLLM 1.107.0 wheels and associated container images. The collector targets cloud, developer and AI-tool credentials; a separate loader can fetch and execute Python code. The investigation linked the payload to a lookalike source in build provenance, but the workflow authorization and wheel-upload path remain unestablished.

    Security Significance: Python startup can trigger the collector without a LiteLLM import, potentially exposing credentials in environments that install the affected release.

  4. Incident

    AOMEI update configuration tampering delivered backdoor payloads

    Google reports that UNC7017 modified AOMEI update configurations during brief windows between April and July 2026. Affected clients could receive a malicious archive through the shared ABMarket update mechanism, delivering the CROSSROAD downloader and SHINYROAD backdoor.

    Security Significance: The operation abused a normal update workflow used by AOMEI Backupper and AnyViewer, potentially exposing clients that checked for updates during the tampering windows.

  5. Incident

    OVHcloud CLI release assets replaced with GlassWorm credential stealer

    Step Security reconstructed a 94-minute window on October 19 in which assets for five OVHcloud CLI releases were replaced. About 250 downloads were disclosed. The attacker replaced assets without changing tags or source or running CI; a rebuild reproduced metadata from the swapped binary.

    Security Significance: Users who downloaded affected release assets during the window may have received a credential stealer. The download count does not establish the number of compromised users.

  6. Incident

    MythicRatatoskr backdoor preceded destructive attack on Ukrainian logistics firm

    ESET says UAC-0099 deployed the previously undocumented MythicRatatoskr backdoor, which communicated over the Yggdrasil mesh network, before handing access to Sandworm. Sandworm then wiped a Ukrainian logistics company's data using SDelete through Active Directory Group Policy.

    Security Significance: The case connects a newly documented backdoor and mesh-network command channel to a destructive intrusion and shows how administrative tooling was used to distribute the wipe.

  7. Incident

    Hundreds of Tor exit relays redirected SSH connections

    A researcher found 333 Tor exits redirecting SSH traffic to interception servers; directory data identified 377 relays that adopted the attacker's exit policy. Passwords could be captured only if users accepted the interception server's host key and then authenticated with a password. Tor removed the affected relays by October 5.

    Security Significance: The activity exposed SSH users who bypassed host-key warnings and used passwords. The number of users whose credentials were exposed is unknown.

  8. Incident

    AI-driven intrusion pivoted from exposed Kafka UI across cloud systems

    Wiz CIRT describes an intrusion in which a Java RCE vulnerability in an exposed Kafka UI was one confirmed initial access vector. The agent harvested Kubernetes tokens and cloud credentials, moved across cloud and development systems, and created an administrator identity with access to AWS single sign-on.

    Security Significance: The observed intrusion shows how an exposed application and accessible credentials can enable broad cloud and identity-system compromise; researchers also observed an attempted data exfiltration.

  9. Vulnerability

    Google fixes cross-tenant Dataflow staging-bucket execution risk

    Varonis describes how an attacker could squat a predictable default staging bucket and replace a Python session pickle used by certain Apache Beam pipelines. The scenario required specific pipeline settings and the victim project not already having created the regional bucket. Google says global fixes add bucket-ownership checks and SHA-256 artifact verification.

    Security Significance: The reported path could have caused Dataflow workers to execute attacker-supplied code across tenants. The research describes a conditional risk, not observed exploitation.

  10. Vulnerability

    BlueHammer chain reaches SYSTEM through Windows Defender components in lab

    Qualys details CVE-2026-33825, an eight-stage local privilege-escalation chain combining CloudFilter callbacks, oplocks, object-manager symlinks and Defender's update RPC interface. Its proof of concept reached SYSTEM on a tested host; Defender platform 4.18.26030.3011 or later closes the vulnerable path.

    Security Significance: The chain could elevate an attacker with existing standard-user code execution. Lab recovery of domain-admin credentials depended on those credentials already being present and is not automatic.

  11. Advisory

    Joint advisory says SafePay ransomware has compromised at least 600 victims

    A joint U.S., U.K. and German advisory says SafePay has compromised at least 600 victims since August 2024. The agencies describe access through stolen credentials, brute force and vulnerabilities in Cisco, Veeam and SonicWall products, followed by data theft and encryption.

    Security Significance: The advisory documents a large ransomware threat affecting businesses and critical infrastructure and identifies access and lateral-movement methods for defenders to address.

Weekly Threat Intelligence

Six Top 7 rankings

Ranked by distinct supporting articles. Open Related Evidence for saved source contexts and CVE details.

Top 7 CVEs

  1. 1CVE-2026-109618
  2. 2CVE-2026-109619
  3. 3CVE-2020-3259 · Cisco Adaptive security appliance software
  4. 4CVE-2022-21894 · Microsoft Windows 10
  5. 5CVE-2023-20269 · Cisco Adaptive security appliance software
  6. 6CVE-2023-27532 · Veeam backup & replication
  7. 7CVE-2024-40711 · Veeam backup & replication

Top 7 MITRE ATT&CK Techniques

  1. 1T1105 · Ingress Tool Transfer
  2. 2T1027 · Obfuscated Files or Information
  3. 3T1190 · Exploit Public-Facing Application
  4. 4T1041 · Exfiltration Over C2 Channel
  5. 5T1071.001 · Web Protocols
  6. 6T1552.001 · Credentials In Files
  7. 7T1555.003 · Credentials from Web Browsers

Top 7 Malware

  1. 1privcollect
  2. 2BlackLotus
  3. 3BlackX
  4. 4CROSSROAD
  5. 5SafePay
  6. 6SHINYROAD
  7. 7ClientHub

Top 7 Threat Actors

  1. 1SPIRE CASTLE
  2. 2Lazarus Group
  3. 3Safepay
  4. 4UNC7017
  5. 5BRONZE SANDCASTLE
  6. 6FishMonger
  7. 7Sandworm

Top 7 Mentioned Countries

  1. 1United States
  2. 2China
  3. 3India
  4. 4South Korea
  5. 5Taiwan
  6. 6Australia
  7. 7Singapore

Top 7 Mentioned Industries

  1. 1Energy
  2. 2Government
  3. 3Manufacturing
  4. 4Telecommunications
  5. 5Construction
  6. 6Cryptocurrency
  7. 7Healthcare
Other Articles (73)
METHODOLOGY AND LIMITATIONS

Reporting period and eligibility

Article selection uses the original publisher publication date within the saved reporting period. Articles without that date are excluded; discovery dates and Cyber publication dates do not substitute for it. Counts include articles meeting public eligibility rules after the saved Weekly Report SCOPE exclusions were applied.

Ranked lists and evidence

Ranked lists show up to seven saved, validated canonical entities per category, ordered by the number of distinct supporting articles. Each article counts once per entity. These are article references, not unique incident counts; multiple articles and publishers may cover the same event.

Related Evidence displays saved entity-specific contexts with publisher identity, publication dates and article links. Missing context is identified explicitly and does not mean a supporting article is missing: the article remains linked and counted. Article summaries are not substituted for unavailable entity context.

Entity mentions do not confirm attribution, infection, exploitation, attacker origin, victim location, targeting or industry compromise. Country and industry contexts retain the original research wording.

Saved CVE details

CVSS, severity, EPSS and CISA KEV details are available inside each CVE's Related Evidence, using saved snapshot enrichment only; unavailable values are Unknown. EPSS estimates exploitation probability, not vulnerability severity or confirmed exploitation. Absence from KEV does not establish absence of exploitation. CVE rankings depend on supporting articles, not scores or KEV status.

Historical and AI limitations

This report uses a saved historical evidence snapshot. Source edits, later enrichment and subsequent reporting do not automatically update it. AI analysis uses bounded editorial selections of summaries, key points and validated relationships; it cannot establish complete coverage of global threat activity. Historical completeness: Unknown.

Ransomware operator claims and leak-site listings are unverified allegations, not confirmed attacks. Repetition by another publisher does not independently verify compromise, data theft or actor involvement.

Evidence panels provide ten articles per page, with every saved reference accessible. Without JavaScript, all references are displayed. Related entity metadata does not increase the supporting article count. Links use saved identities; their availability may change.

ALL CYBER REPORTS