The daily cybersecurity brief
No. 248
15 stories 4 critical 6 min read Updated 08:04 IST
Top stories
- PHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Two critical PHP vulnerabilities allow unauthenticated remote code execution via memory handling flaws. Do this today Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately. Read the full story ↓
- Threat Actors Probing Unpatched Oracle E-Business Suite RCE Flaw Attackers are actively scanning the internet for systems vulnerable to an unauthenticated RCE flaw in Oracle EBS. Do this today Apply the Oracle Critical Security Patch Update released in October 2026. Read the full story ↓
- Sony ISP Subsidiary Data Breach Exposes Customer Records Sony Network Communications suffered a data breach exposing personal information and passwords for over 2.5 million customers. Do this today Advise affected users to change passwords for exposed email accounts. Read the full story ↓
From the editor
Prioritize patching PHP applications against CVE-2026-109618 and CVE-2026-109619 due to unauthenticated RCE risks. Defenses must also monitor for active exploitation attempts targeting Oracle E-Business Suite. Review access controls following the Sony Network Communications data breach.
Anmol Singh YadavEditor, PwnSpectrum
No stories match your search.
Actively Exploited 4
-
PHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Two critical PHP vulnerabilities allow unauthenticated remote code execution via memory handling flaws.
CVE-2026-109618 allows RCE through improper handling of memory after out-of-memory errors. CVE-2026-109619 allows RCE due to global state referencing freed request memory.
Why it matters. These vulnerabilities permit unauthenticated remote code execution on web applications running vulnerable PHP versions. Immediate patching is required to prevent system compromise.
Do this today Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately.
- Affected
- All PHP installations serving web requests
- CVE
- CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
- Thu 22 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- Fri 23 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- Sat 24 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- Mon 26 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- Tue 27 OctPHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE
- Wed 28 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- TodayPHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
{"coverage":1,"evidence":1,"freshness":0.004,"importance":1,"novelty":0.6,"quality":0.95,"total":0.855} -
UAT-11473 Exploits Cisco SD-WAN via CVE-2026-20127 for KeyDrift Access APT group UAT-11473 exploited an authentication bypass in Cisco SD-WAN to deploy KeyDrift for key material exfiltration.
APT group UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances. This allowed unauthorized access to deploy KeyDrift, a custom malware framework. KeyDrift intercepts decrypted control traffic to extract keying material.
Why it matters. The implant provides persistent, in-band access by hooking control-plane processes to exfiltrate sensitive keying material without conventional external beacons.
Do this today Review Cisco SD-WAN runit service paths for unauthorized modifications, especially around sshd and aaamgrd.
- Affected
- Cisco SD-WAN Catalyst Controller instances
- CVE
- CVE-2026-20127
{"coverage":0.387,"evidence":1,"freshness":0.869,"importance":0.75,"novelty":1,"quality":0.95,"total":0.815} -
Volt Typhoon Uses 'Silent Train' Framework for Zero-Day Exploitation Volt Typhoon employs a covert relay network, Silent Train, to conduct zero-day attacks against critical infrastructure.
Volt Typhoon is using a framework called Silent Train, which utilizes rotating chains of compromised SOHO, IoT, and enterprise devices. This network allows the group to conduct zero-day attacks while obscuring the origin of their activity. The group targets sectors including utilities, government agencies, and telecommunications firms.
Why it matters. The use of this relay network and zero-days enables attackers to gain administrative control and exfiltrate data with minimal detection. This indicates a persistent threat focused on critical infrastructure disruption.
Do this today Restrict internet access to administrative interfaces and rapidly patch vulnerabilities.
Summarised from BleepingComputer; also covered by The Hacker News.
{"coverage":0.613,"evidence":0.9,"freshness":0.745,"importance":0.75,"novelty":1,"quality":0.95,"total":0.812} -
Oracle PeopleSoft Zero-Day Involves Three Chained Vulnerabilities PeopleSoft zero-day exploited by ShinyHunters involves three distinct vulnerabilities, not just one.
Attackers exploited a PeopleSoft zero-day, which researchers determined involved three chained vulnerabilities. These flaws include SSRF, an external control of file path vulnerability, and a deserialization flaw in PSEMHUB. Oracle patched these under CVE-2026-35273.
Why it matters. Combining these flaws allows an attacker to achieve remote code execution on affected PeopleSoft instances. Patching alone may not remove web shells already deployed by attackers.
Do this today Patch Oracle PeopleSoft instances to address the three distinct vulnerabilities reported by TrendAI's Zero Day Initiative.
- Affected
- Oracle E-Business Suite, Oracle PeopleSoft
- CVE
- CVE-2026-35273
Also covered by The Hacker News
{"coverage":0.613,"evidence":1,"freshness":0.566,"importance":0.75,"novelty":1,"quality":0.85,"total":0.809}
Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27
Vulnerabilities & Patches 4
-
Threat Actors Probing Unpatched Oracle E-Business Suite RCE Flaw Attackers are actively scanning the internet for systems vulnerable to an unauthenticated RCE flaw in Oracle EBS.
Threat actors are probing for systems unpatched against CVE-2026-101767, an unauthenticated SQL injection in the Oracle Application Object Library. Oracle released a patch for this vulnerability in its October 2026 Critical Security Patch Update.
Why it matters. This flaw allows unauthenticated remote code execution via HTTP network access. Failure to patch increases the risk of compromise for enterprise systems.
Do this today Apply the Oracle Critical Security Patch Update released in October 2026.
- Affected
- Oracle E-Business Suite (EBS)
- CVE
- CVE-2026-101767
Also covered by SecurityWeek, The Hacker News
{"coverage":0.774,"evidence":0.7,"freshness":0.618,"importance":0.75,"novelty":1,"quality":0.95,"total":0.773} -
EDK2 UEFI Firmware Flaw Allows Pre-OS Code Execution via Network Boot A flaw in EDK2 allows unauthenticated code execution during network booting before the OS loads.
A critical flaw in EDK2 UEFI firmware, specifically within the PXE network boot driver, permits unauthenticated code execution. This vulnerability affects ICMP error processing during both IPv4 and IPv6 network boot processes.
Why it matters. Successful exploitation allows an attacker to run malicious code before the operating system loads, bypassing standard OS security controls.
Do this today Review vendor advisories for updates addressing EDK2 PXE network boot driver flaws.
- Affected
- EDK2 UEFI firmware
- CVE
- CVE-2026-97631
- Wed 28 OctEDK2 UEFI Firmware Flaw Allows Early Boot Code Execution
- TodayEDK2 UEFI Firmware Flaw Allows Pre-OS Code Execution via Network Boot
Also covered by The Hacker News, GBHackers
{"coverage":0.774,"evidence":0.7,"freshness":0.433,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.709} -
Adobe Patches 8 Critical Flaws in Campaign Classic Allowing Code Execution Adobe released patches for eight critical flaws in Campaign Classic, allowing code execution and bypass.
Adobe patched eight critical security flaws in Campaign Classic. One vulnerability, CVE-2026-104351, is a code injection flaw that permits arbitrary code execution.
Why it matters. Exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation.
Do this today Apply the patches released by Adobe for Campaign Classic.
- Affected
- Adobe Campaign Classic
- CVE
- CVE-2026-104351
{"coverage":0.387,"evidence":0.7,"freshness":0.654,"importance":0.75,"novelty":1,"quality":0.8,"total":0.703} -
Veeam Backup & Replication: Unauthenticated Authorization Bypass (CVE-2026-108142) Unauthenticated attackers can bypass authorization on the CDP Coordinator Service in affected Veeam Backup & Replication versions.
A critical authorization bypass vulnerability, tracked as CVE-2026-108142, affects the CDP Coordinator Service in Veeam Backup & Replication. This flaw allows unauthenticated attackers to bypass authorization controls. The vulnerability has a CVSS v4.0 score of 9.1.
Why it matters. Unauthenticated access to the CDP Coordinator Service presents a high risk of unauthorized system interaction. Immediate patching is required to prevent exploitation.
Do this today Upgrade Veeam Backup & Replication to version 13.1.2.57 or 13.0.3.63.
- Affected
- Veeam Backup & Replication versions 13.1.1.18 and earlier (13.1 branch); 13.0.2.29 and earlier (13.0 branch)
- CVE
- CVE-2026-108142
Summarised from GBHackers.
{"coverage":0.387,"evidence":0.7,"freshness":0.656,"importance":0.75,"novelty":1,"quality":0.65,"total":0.689}
Malware & Ransomware 3
-
JFrog Reports Worm Arming 42 GitHub Repositories via Large Payload Blobs Attackers compromised 42 GitHub repos using large payloads to evade standard code search and API monitoring.
Researchers identified a worm that armed 42 third-party GitHub repositories. The attack utilized payload blobs measuring 12.9 to 13.7 MB to bypass GitHub's code search and API paths. The payloads included execution hooks for AI coding assistants and IDEs.
Why it matters. This indicates a sophisticated supply chain attack vector targeting developer tools and CI/CD pipelines. Compromised repositories can lead to credential theft and further exploitation.
Do this today Review CI/CD configurations for unusual execution hooks or large, obfuscated dependencies.
- Affected
- GitHub repositories, npm packages
Summarised from The Register; also covered by CSO Online.
{"coverage":0.613,"evidence":0,"freshness":0.235,"importance":0.75,"novelty":1,"quality":0.85,"total":0.526} -
Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets Malicious Firefox extensions impersonating crypto wallets were used to steal private keys and recovery phrases.
Malicious Firefox extensions impersonating crypto wallets were used to steal private keys and recovery phrases.
Summarised from GBHackers.
{"coverage":0.387,"evidence":0,"freshness":0.69,"importance":0.75,"novelty":1,"quality":0.65,"total":0.517} -
Gheist Weaponizes Stolen GitHub Tokens to Exfiltrate Cloud Secrets Gheist plants workflows in repositories using stolen GitHub tokens to print and exfiltrate secrets via Actions logs.
An automated campaign named Gheist uses compromised GitHub tokens to commit a workflow file to repositories. This workflow prints the repository's secrets into the GitHub Actions logs, which are then downloaded by the attackers.
Why it matters. Successful exploitation in private repositories and GitHub Enterprise environments allows credential theft, including environment-scoped production credentials.
Do this today Hunt for branches named ci-sync- followed by six random characters containing a new file at .github/workflows/sync-check.yml
- Affected
- GitHub repositories, GitHub Enterprise environments
- Mon 26 OctGheist: Automated Abuse of Stolen GitHub Tokens Detected
- Tue 27 OctGheist Weaponizes Stolen GitHub Tokens for Cloud Secret Theft
- TodayGheist Weaponizes Stolen GitHub Tokens to Exfiltrate Cloud Secrets
Also covered by Dark Reading, The Hacker News
{"coverage":0.898,"evidence":0,"freshness":0.106,"importance":0.75,"novelty":0.6,"quality":0.85,"total":0.515}
Threat Actors & Campaigns 2
-
Volt Typhoon Uses 'Silent Train' Framework Against Critical Infrastructure Volt Typhoon uses rapidly rotating compromised devices to maintain covert, persistent access within critical infrastructure.
Volt Typhoon utilized a framework called "Silent Train," which involves rapidly rotating compromised SOHO routers, IoT devices, and enterprise infrastructure. This technique allows the group to exploit vulnerabilities, including zero-days, to gain deep and persistent access to victim networks.
Why it matters. The ephemeral and highly disciplined nature of this infrastructure makes detection and disruption difficult, indicating a sustained effort to maintain access to strategic networks.
{"coverage":0.387,"evidence":0,"freshness":0.745,"importance":0.75,"novelty":1,"quality":0.9,"total":0.548} -
Ransomware Affiliate Sentenced for Attacks Targeting Hospitals and Government A former ransomware affiliate received a 70-month sentence for participation in attacks against various sectors.
Artem Stryzhak, a Ukrainian national, was sentenced to 70 months in prison after pleading guilty to charges related to ransomware activity. Stryzhak was an affiliate of Nefilim and later joined the Hive ransomware group. These attacks targeted hospitals, government entities, and businesses between 2018 and 2021.
Why it matters. The activity demonstrates the sustained threat posed by organized ransomware groups targeting critical infrastructure and government services.
Summarised from The Record; also covered by BleepingComputer, CyberScoop.
{"coverage":1,"evidence":0,"freshness":0.411,"importance":0.5,"novelty":1,"quality":0.95,"total":0.536}
Breaches & Incidents 2
-
Sony ISP Subsidiary Data Breach Exposes Customer Records Sony Network Communications suffered a data breach exposing personal information and passwords for over 2.5 million customers.
Sony Network Communications confirmed a data breach compromising 2,585,481 customer records from its So-net and Plala services. The exposed data included personal information and passwords for 54,401 email addresses. No banking or payment card details were compromised.
Why it matters. The exposure of credentials increases the risk of targeted phishing and account takeovers for affected users.
Do this today Advise affected users to change passwords for exposed email accounts.
- Affected
- Sony Network Communications So-net and Plala (S Course) services
Summarised from BleepingComputer; also covered by GBHackers.
{"coverage":0.613,"evidence":0,"freshness":0.666,"importance":0.75,"novelty":1,"quality":0.95,"total":0.579} -
Leak Site Publishes Data on 41,000+ DHS Employees Hacktivists leaked internal data on over 41,000 DHS employees obtained from an Okta single sign-on service.
Hacktivists obtained and published internal data on over 41,000 Department of Homeland Security employees and contractors. The data reportedly originated from an Okta single sign-on service used by DHS. The leak was shared with DDoSecrets and published on a leak site.
Why it matters. The dataset provides insight into DHS organizational structure, including personnel involved in covert operations and various DHS agencies. Exposed contact information can aid in Freedom of Information Act requests.
- Affected
- Department of Homeland Security (DHS) employees and contractors
{"coverage":0.387,"evidence":0,"freshness":0.87,"importance":0.75,"novelty":1,"quality":0.9,"total":0.56}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2026-111497 | Google BrotliA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows… | 9.2 | 88% | Exploited (KEV)CISA due 10 Nov |
| CVE-2026-48356 | Adobe Commerce and MagentoAdobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution… | 9.3 | 59% | Exploited (KEV)CISA due 10 Nov |
| CVE-2026-109618 | PHP Group PHPPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not prope… | 9.8 | 100% | Exploited (KEV)CISA due 29 Oct |
| CVE-2026-109619 | PHP Group PHPPHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may… | 8.1 | 100% | Exploited (KEV)CISA due 29 Oct |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleToolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported v… | 9.8 | 97% | Exploited (KEV)CISA due 15 Jun (passed)ransomware |
| CVE-2026-101767 | —Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are af… | 9.8 | 1% | Not in KEV |
Quiz
Yesterday's answer
According to the news story, what is the potential impact of the CoreGraphics zero-day vulnerability (CVE-2026-86950)??
Arbitrary code execution
The story explicitly states that the vulnerability could allow arbitrary code execution.
Today's question
According to the provided text, what vulnerability mechanism does CVE-2026-109618 exploit to achieve RCE?
Locked in. The answer is in tomorrow's brief.
On the radar tomorrow
- CTF starts Thu 09:00 UTCSrdnlen CTF 2026 Finals (Sardinia Cyber Camp)
- WatchingMultiple Node.js CVEs
- WatchingTailscale warns of SSH flaws allowing root privilege escalation
Also worth your time
Exploits
Tools
- Yamato-Security/hayabusa v4.3.0Added timezone support to multiple commands; resolved unaliased rule fields from both EventData and UserData.
- vaishantsah/watson-AI-osint-all-in-onePerforms digital footprint checks and username lookups across over 3,100 public sources using a single input field.
- UltraSultanHonor/recon-v1.7.0Collects username, email, domain, and image intelligence from over 300 public sources into structured reports.
- jmanico/grim-prompterGenerates evidence-traced threat models for codebases using AI coding agents.
- dbx0/executionerFramework for testing security controls and identifying vulnerabilities in AI systems.
- sazabi/cve.nowAggregates multiple vulnerability databases into a single feed for tracking known security flaws.
Community
- XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)
- Turning the Valve - Exploiting RCE and LPE in the Steam Platform
- An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram
- EDK2 PXE Flaw (CVE-2026-97631): Find What You Run
- Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
- SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
Podcasts
- 181: Ricky
- Risky Business #857 -- AI FUD intensifies
- SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire Drill
- SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs
And finally
AI Agent Exploits Unprotected Models for Autonomous Cyberattacks
Attackers constructed an autonomous agent exploiting unprotected web models. This method, termed LLMjacking, allows for multi-stage cyber operations without human intervention.
Source: Security · via CSO Online
End of No. 248
That's today's brief.
On the radarCTF starts Thu 09:00 UTC: Srdnlen CTF 2026 Finals (Sardinia Cyber Camp)
The next brief lands at 06:30 IST.