CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Thu · 22 Oct 2026
All daily briefs →
Daily brief · UTC day

Thursday, 22 October 2026

6 verified findings from 1 run · 4 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalUpdate the PHP runtime on every internet-facing host todayCVE-2026-109618 +1 · updated 23 Oct 03:45Z
Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01Group-IB: k0t takes edge devices in bulk and decrypts FortiGate configurations offline; enable private-data-encryption. Group-IB and NyxLab report a campaign by an operator they track as k0t that finds exposed FortiGate, FortiWeb and PAN-OS GlobalProtect devices in bulk, exploits FortiWeb CVE-2025-64446 and GlobalProtect CVE-2026-0257 or brute-forces FortiGate logins, downloads each FortiGate configuration and decrypts its stored LDAP, Active Directory and administrator secrets offline with the default FortiOS key, which cannot be seen on the appliance. Group-IB then sees hands-on Active Directory work, remote-management persistence and exfiltration, and victims that later appear on the Qilin and The Gentlemen leak sites; it assesses the operators as probable initial-access brokers but says the link to either group is unconfirmed. →
  2. 02Microsoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique. Microsoft reports that since at least September 2026 Storm-0940, a China-state aligned actor, has used ARTEX, an open-source multi-agent LLM penetration-testing framework, to automate scanning, password spraying and OAuth-application abuse against hundreds of organizations across many industries including government, reaching privileged cloud access in under three hours in several cases. Expel independently saw the same infrastructure create its own accounts through Okta self-service registration, enrol Okta Verify and sign in to applications, and CrowdStrike and Recorded Future document another actor using the same framework. →
  3. 03LiteLLM 1.107.0 on PyPI and in the official images stole cloud and AI credentials; removing the package does not stop it. On 2026-10-21 LiteLLM 1.107.0, the open-source LLM gateway, shipped with malicious Python startup files in all seven PyPI wheels (live 11:39 to 13:23 UTC) and in the official GHCR and Docker Hub images behind the v1.107.0, latest, main-latest and main-stable tags (11:46 to 14:20 UTC); they run a credential stealer at every Python start and start a background loader that could execute code fetched from an attacker-chosen host, though Socket saw its pointer empty at 13:01 UTC. The maintainers say the attacker used three engineers' stolen GitHub CLI OAuth tokens, apparently read from the logs of an internet-exposed internal LiteLLM deployment, to force-push a release-workflow change past branch protection and build from a look-alike repository. Wiz saw stolen AWS instance-role credentials tested about 4.5 hours after exfiltration; PyPI and the registries removed the release the same day and the maintainers say to pin 1.106.2 or an explicit earlier version. →

01Active threats, incidents & disclosures3 items

NOTABLECVE-2025-64446 +2exploitedNATOB2

k0t: Group-IB and NyxLab describe a probable access broker that mass-exploits FortiWeb and PAN-OS GlobalProtect, brute-forces FortiGate and decrypts stolen FortiGate configurations offline with the default key, with victims later listed by Qilin and The Gentlemen

Group-IB and NyxLab describe a campaign by an operator they track as k0t (Group-IB lists CryptoFeel as a potential alias, and Scrooge as a likely collaborator and possible alias) that enumerates internet-facing VPN and firewall appliances in bulk and attacks the product directly, chiefly Fortinet firewalls and Palo Alto GlobalProtect portals (Group-IB, 2026-10-21). A custom script exploits CVE-2025-64446 against FortiWeb, a relative path traversal that lets an unauthenticated attacker run administrative commands, or brute-forces exposed Fortinet devices as a fallback (Group-IB, 2026-10-21; CISA KEV, 2026-10-21). Against PAN-OS it exploits CVE-2026-0257, the GlobalProtect authentication bypass, with a forged authentication-override cookie (Group-IB, 2026-10-21). On a compromised FortiGate the tool downloads the configuration and decrypts its secrets locally with the default FortiOS key, the weakness tracked as CVE-2019-6693, recovering LDAP and Active Directory bind and, Group-IB says, administrator credentials, although Fortinet's advisory excludes the administrator's password and says FIPS-CC devices are not impacted; unless private-data-encryption is set, the device falls back to that known key (Group-IB, 2026-10-21; Fortinet, 2019-11-19).

After access the operators work by hand with NetExec, Impacket, Kerbrute, relayed PetitPotam and Mimikatz, keep access through OpenConnect, MeshCentral agents, AdaptixC2, Atera and AnyDesk, and exfiltrate with Rclone to Wasabi and MEGA (Group-IB, 2026-10-21). Group-IB sees victim overlap with the Qilin and The Gentlemen leak sites and assesses the operators are probably initial-access brokers, but says no relationship is confirmed, and it found indications of a possible connection with the FortiBleed cluster alongside negligible overlap in the compromised credentials (Group-IB, 2026-10-21). CISA lists all three CVEs in KEV, with ransomware use marked known for CVE-2026-0257 and CVE-2019-6693 (CISA KEV, 2026-10-21).

Triage: OpenConnect, MeshCentral, Atera, AnyDesk and Rclone are legitimate tools, so Group-IB advises judging execution context, installation source, operator account, destination and timing rather than tool names (Group-IB, 2026-10-21).

Large-scale campaign involving vulnerability exploitation and brute-forcing of exposed network devices

Many victims seen in this campaign have also been observed to be later listed by ransomware groups, Qilin and the Gentlemen, on their Data Leak Sites (DLS).

Because this decryption is performed against a copy of the configuration held by the operator, it is not detectable on the appliance itself and cannot be prevented by access control alone

Enable the ‘private-data-encryption’ setting on FortiGate appliances and supply an operator-defined key.

Group-IB (with NyxLab) 2026-10-21

Builds on: Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and… · FBI and Secret Service: FortiBleed is still active, locks admins out of FortiGates and feeds…

threat22 Oct 03:46Zsingle-sourceOpen finding →
Sources: Group-IB (with NyxLab) · Fortinet PSIRT (FG-IR-25-910, Path confusion vulnerability in GUI) · Fortinet PSIRT (FG-IR-19-007, Hardcoded symmetric key in fips.c) · Palo Alto Networks PSIRT (CVE-2026-0257 advisory) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.21)
NOTABLENATOB2

ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration

Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them (Microsoft, 2026-10-21). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement (Microsoft, 2026-10-21). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants (Microsoft, 2026-10-21), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse (Expel, 2026-10-21); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours (Microsoft, 2026-10-21). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse (Microsoft, 2026-10-21).

Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked (Expel, 2026-10-21). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before (Expel, 2026-10-21). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September (CrowdStrike, 2026-10-07), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it (Recorded Future, 2026-10-16).

Triage: Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly (Expel, 2026-10-21).

used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries

including multiple instances where the time from initial targeting to privileged access was less than 3 hours

While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

Microsoft Threat Intelligence 2026-10-21

Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them

The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used.

ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.

Expel 2026-10-21

the threat actor is likely a Chinese speaker and financially motivated

CrowdStrike Counter Adversary Operations 2026-10-07

Builds on: ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not…

threat22 Oct 03:45Zmulti-sourceOpen finding →
Sources: Microsoft Threat Intelligence · Expel · CrowdStrike Counter Adversary Operations · Recorded Future Insikt Group
NOTABLENATOB1

LiteLLM 1.107.0: the PyPI wheels and the official Docker images carried a credential stealer and a dormant remote-code loader that Python starts at every launch, published through the maintainers' own release workflow with stolen developer tokens

Socket reports that LiteLLM 1.107.0, an open-source LLM gateway, carries malicious Python startup files in all seven wheels, and that Upwind found the same payload in the published images (Socket, 2026-10-21). A startup hook and a second startup module in the Python library directory run at every Python start without the application importing LiteLLM: the first collects cloud, Kubernetes, CI, registry and database credentials, SSH, GPG and TLS private keys, browser stores, AI-tool credential files, environment variables and, where configured, the credentials saved in a LiteLLM proxy database; the second forks a detached loader that polls a file in a GitHub repository for a domain and would execute Python downloaded from it with no signature or hash check, though at 13:01 UTC the pointer returned an empty body, which stops the loader before its download stage (Socket, 2026-10-21).

The payload is not in the git tag: a packaging setting in an untagged commit pulls it into the wheel, and the container build provenance records a source repository named Berri-AI/litellm, one hyphen away from BerriAI/litellm (Socket, 2026-10-21). The maintainers say stolen GitHub CLI OAuth tokens of three engineers drove the release: one account started the run, another approved it, a third deleted the workflow records, and an organisation owner's token disabled branch protection so that a change pointing the releaser at the look-alike repository could be force-pushed (GitHub issue #47826, 2026-10-21; LiteLLM, 2026-10-21). They believe the tokens were read from the logs of an internet-exposed internal LiteLLM deployment, note that Claude Code can embed a user's GitHub CLI OAuth token in a response body that deployments log, and suspect, unconfirmed, a recently patched vulnerability; an embargoed fix for a vulnerability due for disclosure on 2026-10-27 goes to enterprise customers through a private registry (LiteLLM, 2026-10-21). PyPI quarantined 1.107.0 and the images were pulled the same day (Aikido, 2026-10-21; LiteLLM, 2026-10-21).

contains malicious Python startup files that collect cloud credentials, private keys, browser data, and authentication files for AI development tools

starting Python or pip in an affected environment to inspect or repair the installation can execute the payload again

removing the LiteLLM package directory alone does not remove those files or stop an existing process

Socket Research Team 2026-10-21

We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens.

GitHub issue BerriAI/litellm #47826 (Upwind report, with maintainer replies) 2026-10-21

We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow.

LiteLLM maintainers (security incident post) 2026-10-21

Each credential was checked with sts:GetCallerIdentity, followed by bedrock:ListFoundationModels and a ListModels call, consistent with LLMjacking.

Wiz Research 2026-10-21

PyPI has now quarantined version 1.107.0.

Aikido Security 2026-10-21
incident22 Oct 03:44Zmulti-sourceOpen finding →
Sources: Socket Research Team · LiteLLM maintainers (security incident post) · GitHub issue BerriAI/litellm #47826 (Upwind report, with maintainer replies) · Wiz Research · Aikido Security
NOTABLECVE-2026-76466 +4NATOA2

CVE-2026-76466, Cisco Expressway-C and Expressway-E: unauthenticated root command execution on clustered devices, fixed in X15.5.20 with no workaround (CVSS 9.8), alongside same-day hardening releases for Unified CM, Unity Connection and Snort 3

Cisco's advisory of 2026-10-21 fixes CVE-2026-76466 (CVSS 3.1 9.8, network, no privileges, no user interaction) in the database service of Expressway-C and Expressway-E, virtual and appliance: an unauthenticated remote attacker with network access can run operating-system commands as root (Cisco PSIRT, 2026-10-21). The cause is the use of persistent cookies together with insufficient validation of client certificates for clustering, even when TLS Verify Mode is enabled; an attacker who possesses the cookies connects to the database service and invokes remote procedure call commands, and Cisco does not say how an attacker obtains the cookies (Cisco PSIRT, 2026-10-21). Only devices configured in a cluster are affected; X15.5.3 and earlier are fixed in X15.5.20, X14 and earlier must migrate to a fixed release, there is no workaround, and Cisco's PSIRT is not aware of any public announcement or malicious use (Cisco PSIRT, 2026-10-21). The X15.5.20 release also carries Expressway's own hardening fixes, whose worst class scores 8.6 (Cisco PSIRT, 2026-10-21).

The same day Cisco ships two further hardening releases whose worst classes are exploitable over the network without authentication. For Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of device configuration, the worst classes score 9.8 (CVE-2026-76473, improper control of a resource through its lifetime, and CVE-2026-76474, improper authentication); release 15 is fixed in 15SU5 and release 14 must migrate (Cisco PSIRT, 2026-10-21). For Snort 3 in Secure Firewall Threat Defense, Cyber Vision, Unified Threat Defense (UTD) on IOS XE and other Snort-based products, the worst classes score 9.0 with high attack complexity (CVE-2026-20043, an out-of-bounds write, and CVE-2026-20236, an incorrect calculation); FTD is fixed in 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0, Snort in 3.12.4.0, Cyber Vision in 5.6.0 and UTD on IOS XE in 17.12.8, 17.15.6, 17.18.5, 26.1.2 and 26.2.1, while Meraki MX devices that are online and connected to the Dashboard and Cisco's cloud firewall services were updated automatically on 2026-10-21 (Cisco PSIRT, 2026-10-21). Cisco says the flaws were found during internal security testing using existing processes as well as frontier AI models, and are not known to be actively exploited (Cisco PSIRT, 2026-10-21; Cisco PSIRT, 2026-10-21).

This vulnerability affects Cisco Expressway-C and Cisco Expressway-E, both virtual and appliance versions, if they are running a vulnerable release and have the devices configured in a cluster.

there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering

There are no workarounds that address this vulnerability.

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability) 2026-10-21

These vulnerabilities were found during internal testing and are not known to be actively exploited.

Cisco PSIRT (cisco-sa-voice-hardening-twgbH9e3, Unified Communications Products Security Hardening Release) 2026-10-21
vulnerability22 Oct 03:43Zsingle-sourceOpen finding →
Sources: Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability) · Cisco PSIRT (cisco-sa-voice-hardening-twgbH9e3, Unified Communications Products Security Hardening Release) · Cisco PSIRT (cisco-sa-hardening-snort3-ybgmhTQe, Snort 3 Security Hardening Release) · Cisco PSIRT (cisco-sa-exwy-hardening-FhcqBVcs, Expressway Series Security Hardening Release)
NOTABLECVE-2026-110264NATOA2

CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)

GitLab's ad-hoc critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow while compiling a specially crafted regular expression that could let an unauthenticated user execute code on the GitLab server (GitLab, 2026-10-21). GitLab's detection write-ups place the flaw in the rendering of Org-mode files: the org-ruby gem builds a regular expression from a custom TODO keyword in a .org file, a keyword with more than 32,767 repeats makes the Onigmo engine write out of bounds when it matches, and with heap grooming that becomes command execution as the git user (GitLab security, 2026-10-21). The attack needs no authentication, only one public project that can hold the .org payload (GitLab security, 2026-10-21). Affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1; GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action (GitLab, 2026-10-21). The builds 19.4.2, 19.3.5 and 19.2.8 from GitLab's earlier regular-expression fixes do not contain this fix (GitLab security, 2026-10-21). GitLab does not state that the flaw is exploited, and its patch notes and detection pages mention no public proof of concept (GitLab, 2026-10-21).

Triage: a reader of documentation .org files renders each file once and quickly, while an attack produces a burst of timeouts from one client over a few minutes (GitLab security, 2026-10-21); a worker crash with no accompanying render burst from one client is more likely a benign parser bug than an attack (GitLab security, 2026-10-21).

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) 2026-10-21

only one public project that can hold the .org payload

GitLab security (detection: Org-mode render error burst) 2026-10-21

a successful CVE-2026-110264 exploit is quiet and does not reliably crash

GitLab security (detection: Onigmo native worker crash) 2026-10-21

Builds on: GitLab's CVSS 10.0 CI regex flaw now has a public PoC; the demonstrated path needs push access…

vulnerability22 Oct 03:42Zsingle-sourceOpen finding →
Sources: GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) · GitLab security (detection: Org-mode render error burst) · GitLab security (detection: Onigmo native worker crash)
NOTABLECVE-2026-109618 +1updatedNATOA2

CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS, Panorama and WildFire WF-500 appliances: the PHP2Shell flaws affect every release, reaching PAN-OS through its management web interface; PAN-OS hotfixes are scheduled for 2026-10-26 to 2026-10-30, Panorama and WF-500 have no date

Palo Alto Networks' advisory of 2026-10-21 lists every release of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and of Panorama as affected by CVE-2026-109618 and CVE-2026-109619, with no fixed build released (Palo Alto Networks, 2026-10-21); the revision of 2026-10-23 adds the WildFire appliances WF-500 and WF-500-B, all versions, gives estimated dates from 2026-10-26 to 2026-10-30 for hotfix builds of every PAN-OS train, leaves Panorama and WF-500 undated, and notes that Cortex XCORE (SaaS) and WildFire Cloud were remediated on 2026-10-21 and 2026-10-22 (Palo Alto Networks, 2026-10-23). The two flaws are the unauthenticated remote-code-execution bugs in the PHP runtime that the PHP project fixed in its releases of the same day (PHP, 2026-10-21). Palo Alto says no special configuration is required to be affected, that the issue strictly affects the management web interface, which includes the HTTPS web UI and the XML API service, and that a dataplane interface is affected only where a management profile is attached to it (Palo Alto Networks, 2026-10-21). It states that the GlobalProtect portal and gateway and the captive portal are not impacted (Palo Alto Networks, 2026-10-21).

Palo Alto describes the flaws as remote code execution but scores their impact on its own product CVSS-B 8.7 (severity high, urgency moderate), with high availability impact and none on confidentiality or integrity, against a vendor-level 9.2 with high impact on all three, and says the risk is highest where management access is allowed from external addresses on the internet; restricting management to a single jump box lowers its rating to 7.1, and it is not aware of any malicious exploitation against its products (Palo Alto Networks, 2026-10-21). Unit 42 says it has seen proof of concept of the PHP flaws (Unit 42, 2026-10-21). Until fixes ship, Palo Alto recommends restricting management access to trusted internal addresses and offers Threat Prevention coverage (Threat IDs 543004, 97622, 97623, 97624 and 97625, Applications and Threats content version 9162 and later) that applies only when management traffic is routed through a dataplane interface, the certificate for inbound management traffic has been replaced, and threat prevention is enabled on that traffic (Palo Alto Networks, 2026-10-21).

This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.

This issue will be fixed in the upcoming releases of PAN-OS.

Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.

No special configuration is required to be affected by this issue.

Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) 2026-10-21

Unit 42 has seen proof of concept of these vulnerabilities.

Palo Alto Networks Unit 42 (threat brief) 2026-10-21

Although WildFire Cloud was previously impacted, a remediation patch was deployed on October 22, 2026.

Palo Alto Networks PSIRT (advisory, revised 2026-10-23) 2026-10-23
Updaterun 2026-10-23T0256Z-inteltitleheadlinesummaryentitiesaffected_productscvessourcesevidencebody

Palo Alto Networks revised its advisory on 2026-10-23: the WildFire appliances WF-500 and WF-500-B are now listed as affected in all versions, and the footnotes say Cortex XCORE (SaaS) was remediated on 2026-10-21 and WildFire Cloud on 2026-10-22 (Palo Alto Networks, 2026-10-23). The advisory now also gives estimated availability dates for hotfix builds of every supported PAN-OS train, from 2026-10-26 (for example 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16) to 2026-10-30, while Panorama and the WildFire appliances remain with no date (Palo Alto Networks, 2026-10-23). Palo Alto still states that it is not aware of malicious exploitation against its products, and the Threat Prevention coverage and the jump-box restriction are unchanged (Palo Alto Networks, 2026-10-23). The advisory names the management web interface only for PAN-OS and does not say which interface of the WildFire appliances is reachable.

Builds on: PHP2Shell: fixed PHP builds are out and attack traffic is already hitting unpatched servers… · Palo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no… · Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and…

vulnerability22 Oct 03:41Zsingle-sourceOpen finding →
Sources: Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) · Palo Alto Networks PSIRT (advisory, revised 2026-10-23) · Palo Alto Networks Unit 42 (threat brief) · PHP (security advisory)

03Updates to prior coverage4 items

HIGHupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Updaterun 2026-10-22T0256Z-intelbodyevidencesourcessourcing_notesummary

Netzwoche, relaying Tages-Anzeiger, reports that the Federal Council and the security authorities now assume data on practically all current and former federal and federally affiliated staff left, federal judges and former Federal Council members among them, and that an on-site inspection at PK Softech on 2026-10-07 established the outflow of security-relevant data; neither the Confederation nor Publica has confirmed the actor, the demand or the scope.

Netzwoche updated its running story on 2026-10-21, relaying the paywalled article that Tamedia's Tages-Anzeiger published on 2026-10-20: the Federal Council and the security authorities now assume that data on practically all current and former employees of the Confederation and of federally affiliated bodies left, among them federal judges, former Federal Council members (the sitting members are said to be spared), intelligence-service staff, elite soldiers and cleaning staff (translated from German; Tages-Anzeiger, 2026-10-20; Netzwoche, 2026-10-21). According to the paper, an on-site inspection at PK Softech on 2026-10-07 established the outflow of security-relevant federal data, and Publica's letter to its insured persons mentions neither Akira nor the ransom demand (Netzwoche, 2026-10-21). This is one chain of reporting, and the article quotes no confirmation of the actor, the ransom demand or the scope from the Confederation, Publica or PK Softech (Netzwoche, 2026-10-21).

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Netzwoche (running story, update of 2026-10-21) · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Publica (Pensionskasse des Bundes), page updated through 2026-10-21 · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · Inside IT · NZZ · Blick (SonntagsBlick) · Tages-Anzeiger (Tamedia, paywalled) · Tages-Anzeiger (Tamedia, paywalled; summary lines readable) · 20 Minuten · Ticinonline (relaying Corriere del Ticino) · TicinoNews
NOTABLEupdatedNATOA2

OVHcloud CLI: release binaries of already-published versions were replaced on 2026-10-19 with a build that steals secrets from disk, uploaded through a developer's GitHub account

First published 2026-10-20 · open finding →

Updaterun 2026-10-22T0256Z-intelbodyevidencesourcessourcing_notesummarytechniques

OVHcloud's postmortem traces the account compromise to a poisoned editor extension installed on a developer's personal MacBook on 2025-10-20, ties it to the GlassWorm actor through a Solana wallet, describes a stealer that reads AI-agent data stores and cloud and developer credentials and exfiltrates through Solana RPC calls, and names a missing release-immutability setting as the main issue; the malicious assets were online for 1h33 and downloaded about 250 times.

OVHcloud published its advisory and postmortem. It says the compromised account belongs to a developer who installed the editor extension color-picker-universal 2.8.91 on a personal MacBook on 2025-10-20; the extension queries a Solana wallet that OVHcloud says belongs to the GlassWorm actor, a persistent Node.js service was registered on the laptop, and several personal repositories of the account were compromised in March 2026. The release replacement was made with stolen keys, not from that laptop, and OVHcloud says neither the developer's OVHcloud laptop nor its internal CI/CD was compromised as far as it knows (OVHcloud, 2026-10-20). OpenSourceMalware reads the same account as already compromised for seven months, which is its assessment, and says that the same actor made both steps is its inference (OpenSourceMalware, 2026-10-19).

OVHcloud describes the payload as the original CLI recompiled with embedded stealer code that copies a list of credential files and AI-agent data stores into a temporary folder named envchecker, archives them and exfiltrates through Solana RPC calls and an upload endpoint; the malicious assets were online for 1h33 and downloaded about 250 times (OVHcloud, 2026-10-20). It names the missing release-immutability setting as the main issue, says it allows developers to attach personal GitHub accounts to the organisation, and reports that it enabled immutable releases on every repository, suspended the account, reviewed write access and repository logs without finding another compromise, and published v0.16.0 with a signed tag as the clean release (OVHcloud, 2026-10-20).

Sources: GitHub issue ovh/ovhcloud-cli #300 (external reporter, with OVHcloud maintainer replies) · Octave Klaba, OVHcloud founder (post on X) · OpenSourceMalware · OVHcloud (security advisory and postmortem)
HIGHexploitedupdatedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two

First published 2026-10-18 · open finding →

Updaterun 2026-10-22T0256Z-intelbodyentitiesevidencesourcessourcing_notesummary

Microsoft Threat Intelligence assesses that Storm-0940, a China-state aligned actor, was responsible for the compromise, using the ARTEX agentic-AI framework to attempt sign-ins to more than 2,250 tenants after an automated password spray from the same network range, and warns that credential changes planted in tenants can persist after the vendor application is remediated. ConnectWise itself says it appears a China state-aligned group was responsible and began restoring services in controlled phases on 2026-10-21.

Microsoft Threat Intelligence assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the compromise. It says AI agents running the ARTEX framework kept signing in to customer tenants as the ConnectWise applications, without an interactive user sign-in, and in multiple tenants went on to Microsoft Graph reconnaissance, application credential changes and attempts to change privileges (Microsoft, 2026-10-21). It counts attempted sign-ins to more than 2,250 tenants at up to 2,900 attempts a minute and links the activity to an automated cross-tenant password spray between 2026-10-10 and 2026-10-14 against 327 accounts at eight organizations, from the same network range and including an address that ConnectWise's advisory later listed among its indicators; the spray produced no successful authentication (Microsoft, 2026-10-21).

Microsoft warns that the application credential changes can remain active as a backdoor after the vendor application is remediated, and asks tenants to review service-principal sign-ins from at least 2026-10-15, and from 2026-10-01 where records exist, together with the Entra audit trail for credential additions, role assignments, consents and owner changes (Microsoft, 2026-10-21). Expel, which analysed the activity separately, relays the attribution, notes that ConnectWise's fix leaves secrets planted on other applications in place and that Graph directory reads leave no Entra audit record, and says Huntress has not tied its Global Administrator observation to the same operator (Expel, 2026-10-21). ConnectWise itself says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears a China state-aligned group was responsible and used an openly available agentic AI framework (ConnectWise, 2026-10-21). It began restoring services in controlled phases on 2026-10-21, expects it to take several days, says the start of restoration does not mean all capabilities are available, and tells partners to keep affected connections disabled until formal instructions apply to their service, while noting that its actions do not remove unauthorized access already established in individual customer tenants (ConnectWise, 2026-10-21; heise online, 2026-10-21). ConnectWise publishes updates twice daily from 2026-10-22 (ConnectWise, 2026-10-21).

Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer · SpecterOps · Sophos X-Ops · Microsoft Threat Intelligence · Expel · heise online
CRITICALCVE-2026-109618 +1updatedNATOA1

CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)

First published 2026-10-21 · open finding →

Updaterun 2026-10-22T0256Z-intelactionsbodyclassificationconfidencecvesevidenceheadlineimmediate_actionpriorityregionssourcessourcing_notesummarytagstechniquestitle

The fixed releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) shipped on 2026-10-21, so the earlier no-fix status ends; Cloudflare, watchTowr and VulnCheck report attack traffic and at least one unsuccessful web-shell attempt, proofs of concept are circulating, VulnCheck holds an exploit that succeeds with ASLR enabled and no source reports a confirmed compromise, so priority moves to critical. Swiss cantons, universities, the Lodur fire-brigade platform and Publica took sites offline as a precaution, and BACS, CERT-EU and ENISA tell operators to update the runtime, check embedded installations and look for compromise.

The fixed releases shipped on 2026-10-21 between 13:30 and 14:00 UTC, depending on the source, together with the technical advisories, so the earlier statement that no fix existed no longer holds (CERT-EU, 2026-10-21; ENISA, 2026-10-21; Sansec, 2026-10-21). ENISA, the European Commission, CERT-EU, Europol EC3 and the CSIRTs network advise organisations to identify their PHP-based applications, coordinate with hosting and service providers, apply the update to internet-facing systems first, and isolate exposed applications from public networks where that is not possible (ENISA, 2026-10-21). BACS published its warning the same day, telling operators to check embedded and internal PHP installations as well as public sites, to restart long-running PHP processes and rebuild containers, to verify the running version, and, where an immediate update is impossible, to consider disconnecting critical applications from the internet (BACS, 2026-10-21). BACS told RTS it knows of no reliable, confirmed substitute for the updates and that the interim measures give no guaranteed full protection (RTS, 2026-10-21).

Attack traffic was reported on the day: Cloudflare saw it against its customers while the flaws were still leaked, watchTowr's honeypots recorded exploitation, and VulnCheck's canary hosts logged scanning from 08:37 UTC and at least one unsuccessful web-shell attempt through a session file, while VulnCheck says it holds a working exploit for CVE-2026-109618 that succeeds on x86-64 with ASLR enabled; no source reports a confirmed compromise (Cloudflare, 2026-10-21; watchTowr, 2026-10-21; VulnCheck, 2026-10-21). Palo Alto Networks confirmed that every PAN-OS and Panorama release is affected through the management web interface, with no fixed release yet (Palo Alto Networks, 2026-10-21).

Public-sector sites went offline as a precaution, mostly on the evening of 2026-10-21. The canton of Basel-Stadt activated its crisis staff and shut down every PHP-run cantonal website with no restoration time given, while stating that no security-relevant incident had been registered (Canton of Basel-Stadt, 2026-10-21). The Ticino cantonal administration temporarily disabled some online services, the website of the University of Geneva was unreachable, and the EPFL site displayed a notice that its pages were currently unreachable, although nau.ch says it still worked (nau.ch, 2026-10-21); RTS lists the EPFL and University of Geneva sites as temporarily suspended (RTS, 2026-10-21). Several Neuchâtel canton and city sites were unreachable without an official statement; Arcinfo presumes a link to the PHP flaw, which the state had not confirmed (RTS, 2026-10-21). Lodur, the platform many Swiss fire brigades use to manage their fire brigades and alarm groups, was out of service because its provider took its servers offline as a precaution: users could neither read stored data nor edit alarm groups, though the Valais cantonal fire office said this does not necessarily mean the alarm-triggering systems are down (nau.ch, 2026-10-21; RTS, 2026-10-21). Publica took its website offline on the afternoon of 2026-10-21 as a precaution, says it has closed the vulnerabilities with security updates and was back online that evening, and states the outage is unrelated to the cyberattack on its software supplier (Publica, 2026-10-21). Dutch authorities took DigiD, MijnOverheid, Overheid.nl, TweedeKamer.nl and the tax authority offline for a time, and most were back by that evening (Security.nl, 2026-10-21); RTS reports that the site of the Paris police prefecture was also suspended (RTS, 2026-10-21). Basel-Stadt said it would report on progress on the morning of 2026-10-22, and no restoration status had been published as of the early morning of 2026-10-22 UTC.

Sources: PHP (php.net news archive, Upcoming Critical PHP Security Release) · CERT-EU (Security Advisory 2026-018) · Sansec · Wordfence · PHP (php.net news archive, Security advisory: Critical remote code execution vulnerabilities, update now) · PHP (GitHub security advisory, CVE-2026-109618) · PHP (GitHub security advisory, CVE-2026-109619) · PHP Foundation · Cloudflare · watchTowr (vulnerability FAQ) · VulnCheck · Security.nl · CISA Known Exploited Vulnerabilities catalog (version 2026.10.21) · Palo Alto Networks PSIRT (advisory) · BACS (Federal Office for Cybersecurity, warning) · ENISA (joint statement with the European Commission, CERT-EU, Europol EC3 and the CSIRTs network) · Canton of Basel-Stadt (communiqué, via nau.ch) · nau.ch (Keystone-SDA) · RTS · Publica (status page, status as of 2026-10-21) · Inside IT · SRF · watson.ch (Keystone-SDA) · UKAuthority · The Register · Red Hat (CVE page) · Fortinet PSIRT (FG-IR-26-186) · Splunk (SVD-2026-1013) · WatchGuard PSIRT (WGSA-2026-0032) · NetScaler Product Security (Citrix Tech Zone) · Cisco PSIRT (cisco-sa-php-october26-Jj384Daq)

04Action items6 items

Verification & coverage notes1 run

2026-10-22T0256Z-intel · Sonnet 5.5 · window 26 h · 6 entries published

Verification & coverage notes

Window: gap 24.0 h from 2026-10-21T0256Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Thursday-morning fire dominated by one story: the PHP release that the previous fire had published at 11 h before it landed as "no fix yet" shipped at about 13:30 UTC on 2026-10-21, with technical advisories, attack traffic from three telemetry owners, and Swiss cantons, universities, a fire-brigade platform and Publica taking sites offline. The rest of the window is one vendor bulletin that matters (GitLab), a no-fix vendor advisory that follows from PHP (PAN-OS), Cisco's scheduled run, a supply-chain compromise (LiteLLM), two threat-research items on identity and edge-device tradecraft, and three root-cause or scope developments on covered incidents.

KEV sweep (work/2026-10-22T0256Z-intel/kev-window.txt, catalogue 2026.10.21): no KEV addition inside the window; S1 read the catalogue twice and confirmed it, and nothing carried a RANSOMWARE row. Neither PHP CVE is KEV-listed; CVE-2025-64446, CVE-2019-6693 and CVE-2026-0257 are, which the k0t entry cites.

Backlog (state/coverage_backlog.md): no open row, nothing carried or added.

Published (6 new): pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (notable: no fixed release on any train, a firewall management plane, Palo Alto scores the PAN-OS impact as availability only and knows of no exploitation against its products, no action item because the management-interface restriction already stands on the CVE-2026-0322 entry; declares the PHP entry and the two earlier PAN-OS entries in references[]), cve-2026-110264-gitlab-org-mode-renderer-unauth-rce (notable: unauthenticated CVSS 10.0 path to code execution on self-managed GitLab, clears PD-11(b) through its own mechanics, GitLab ships detections and its pages state neither exploitation nor a public proof of concept), cve-2026-76466-cisco-expressway-cluster-unauth-root-rce (notable: the scheduled-release row of Cisco's 2026-10-21 run, with the Unified CM family and Snort 3 hardening releases that reach the 9.0 bar, none reported exploited), litellm-1-107-0-pypi-docker-credential-stealer-lookalike (notable: S1 and S3 returned it, merged), artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse (notable: Microsoft's attribution plus Expel's Okta self-registration observation; CrowdStrike and Recorded Future corroborate other users of the tool) and k0t-fortiweb-fortigate-globalprotect-edge-device-campaign (notable: single vendor source, declares the CVE-2026-0257 and FortiBleed entries in references[]). Updated (4): the PHP entry (moved to critical: unauthenticated runtime RCE, fixed builds out, attack traffic observed by Cloudflare, watchTowr and VulnCheck, public proofs of concept circulating, authorities telling operators to patch today; nothing confirmed as compromised and neither CVE KEV-listed, so exploitation is written as attempts), the ConnectWise entry (Microsoft's Storm-0940 attribution, the 2,250-tenant attempt count and the restoration start), the OVHcloud CLI entry (root cause, payload and exfiltration from OVHcloud's postmortem) and the Publica entry (the assumed scope of practically all federal and federally affiliated staff, one chain of reporting).

Deep dive: none. PHP2Shell already has its entry and the exploitation evidence is attempts only; no other candidate clears the bar.

borderline-drop lines:

  • borderline-drop: Fortinet FortiSIEM CVE-2026-106173 (9.4, unauthenticated, public Horizon3 proof of concept) (S1) - only 7.5.0 is affected, the gRPC port is normally an internal management plane and no source reports exploitation; reopen on an exploitation report. S1 offered it as borderline.
  • borderline-drop: CrowdStrike's four agentic-AI actors (S3) - gated report, vendor summary only, no detection specifics and no Swiss victim; the ARTEX entry carries the transferable lesson.
  • borderline-drop: Symantec's Skynet LLMjacking agent (S3) - hijacks exposed LLM endpoints and AI gateways, no constituency exposure.
  • borderline-drop: Tor exit-relay SSH interception with Ebury 1.8.3 (S3) - SSH over Tor is not a constituency practice.
  • borderline-drop: Cisco Talos trusted-platform message abuse, Huntress finger.exe ClickFix and Abnormal AI Athena StealthRoute (S3) - delivery and phishing-as-a-service variants with no new detection decision.
  • borderline-drop: NorForge exposed Cairn panels, Pillar Security opencode flaw patched without a CVE, and two Wiz CIRT posts (S3) - lookback items below the bar; the Wiz feed is added to the next rotation.
  • borderline-drop: EFK audit of federal Microsoft 365 (S2) - oversight findings with no patch, hunt, block or detect decision; the audit report is accepted by the BIT and binds no other body.
  • borderline-drop: CERT-FR CTI-008 report on web-application data breaches (S2) - statistics and generic principles, dated 2026-10-20.
  • borderline-drop: BACS week-42 review (TWINT relay phishing) and the Swiss Government Cloud tender (S2) - consumer fraud and procurement.
  • borderline-drop: Zeabur and Railway environment-variable breaches, Onamae.com Desktop Cloud, UK ICO reprimands of Ogi Networks and Data Cymru, Kreisverwaltung Oberspreewald-Lausitz (S4) - no constituency nexus, a two-year-old incident, or a precautionary shutdown with no attack confirmed (incident floor).
  • borderline-drop: Plex and SiteGuard KEV rows, Chrome 156, the Mozilla dot releases, Laravel, Roundcube, the WordPress plugin batch, MikroTik token replay, Splunk, Apache Traffic Server and Pulsar, the lesser Cisco advisories, the rest of the Fortinet October batch and the ICS advisories (S1) - already dropped by the previous fire, routine, out of window, authenticated, or without constituency exposure. The October Patch Tuesday CVRF still shows Windows Shell CVE-2026-96951 as the only exploited flaw.

Single-source and carve-outs: the PAN-OS, GitLab and Cisco entries rest on the vendors' own advisories (reliability A, single-source); the k0t entry rests on Group-IB with NyxLab alone (B2), with the three CVEs independently KEV-listed; the Storm-0940 attribution is Microsoft's alone and Expel relays it; the Publica scope claim rests on Tamedia's paywalled article relayed by Netzwoche (the ICTjournal copy returned an empty body and is not cited). Contradictions: EPFL's site displayed a not-reachable notice while nau.ch says it still worked, and RTS lists it as suspended; the PHP entry reports both.

Verification: eight iterations of the single cold verifier, none CLEAN. Iteration 1 returned 24 findings (truth 5, editorial 10, advisory 9), among them a real error on LiteLLM: the build authorisation was in the maintainers' own status updates, which the run had not read. Each later pass checked the previous fixes first and then walked the ledger. Truth plus editorial counts ran 15, 8, 6, 6, 3, 3, 4 and 5; the later findings were mostly low-confidence one-clause attribution items, a few caused by an earlier fix (the PHP CVE-mapping sentence, a stray parenthesis) and two by cited pages that changed after the run read them (VulnCheck's weaponized exploit that succeeds with ASLR enabled, ConnectWise's archived advisory updates), both now in the entries. Iteration 8 was the cap, so the run publishes fail-open. The five iteration-8 truth findings were fixed by the main agent afterwards (the ConnectWise indicator date, the Lodur description, the Meraki qualifier, 'at least one' web-shell attempt, the run-record GitLab sentence) and are not re-verified, which is why the residual count is 5, not 0. Declined across passes: the OVHcloud staging-folder and extension names, the PHP exploited status, the watchTowr date label and the PAN-OS reference to the CVE-2026-0257 entry. For the audit: the CVE-2026-97229 GitLab entry still says to upgrade to 19.4.2, 19.3.5 or 19.2.8 now, which the CVE-2026-110264 entry says stay affected; the ConnectWise Trust Center is walled live and its 2026-10-21 updates were read from an archived copy through the metered jina reader; and the PHP entry's VulnCheck exploit wording deserves an independent read.

Source health (tools/source_health.py, 259 probed): nine fresh flags, four cleared in this run. efk-ch and bs-ch-medienmitteilungen got content_scope: general-news (general press and audit listings, mostly non-security by design), cyberattaque-org read again minutes after the sweep (transient), and fox-it-blog is demoted with one reliability-tier drop because blog.fox-it.com now serves a coming-soon placeholder with no posts (the publisher is covered by ncc-research). Five flags are origin-side outages no recipe can repair and stay in rotation with a note: cnil-fr (503 maintenance page), dcod-ch (503), zimbra-security-advisories (502), ec-digital-strategy-newsroom (403 on every transport, which never demotes) and lab52 (TLS reset).

Coverage: all 21 essential sources were attempted and every slice record was attempted (S1 18, S2 27, S3 14, S4 10 plus ransomware-live, databreaches-net and sec-disclosures-edgar). The previous two fires' attempts excluded 10 sources from the rotational ranking, and S4's slice was topped back up with all 10 recently attempted records because the exclusion would have emptied it. Entities added: four, plus two product records from sync_products.py. Promoted: swissinfo-ger. New candidates: php-net-news (first-party PHP security announcements), efk-ch (federal audit reports) and nau-ch (fast Swiss relay of cantonal communiqués); the sub-agents also proposed thephp-foundation-blog, watchtowr-intelligence, tio-ch, norforge, pillar-security-blog, safedep-blog and abnormal-ai-threat-intel, which are left for the audit's source pass. The extract transport fell to the metered reader for Wordfence, ICTjournal, Dark Reading and the CNIL maintenance page; the notes on those records say so.

Next-fire watch: Basel-Stadt's promised status update of 2026-10-22 and any compromise report from a PHP-running public body, PAN-OS fixed releases and a KEV listing for either PHP CVE, whether the Confederation, Publica or the Federal Prosecutor confirms the actor or the scope for PK Softech, Basel-Stadt and other cantonal restoration, ConnectWise's restoration instructions, the LiteLLM maintainers' next incident updates and the vulnerability they scheduled for disclosure on 2026-10-27 (a changelog record on the LiteLLM entry when it lands). For the audit: trendmicro-research recipe check (feed stale since 2026-09-25) and including wiz-blog in the next rotation.

Coverage gaps: zimbra-security-advisories (HTTP 502 on every transport), dcod-ch (HTTP 503 on feed and homepage), cnil-fr (503 maintenance page), connectwise-trust-center (403 on every transport), prodaft (no dated listing), news-admin-ch (only the 12 newest cards reachable), tagesanzeiger.ch (paywalled body, lead read), trendmicro-research (feed stale, no in-window post confirmable), citizen-lab (feed lags, listing used).