CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Tue · 27 Oct 2026
All daily briefs →
Daily brief · UTC day

Tuesday, 27 October 2026

3 verified findings from 1 run · 8 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalUpdate the PHP runtime on every internet-facing host todayCVE-2026-109618 +1 · exploited · updated 28 Oct 03:41Z
Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle products. Industrial, building and network-access vendors have published their own notices for the PHP flaws CVE-2026-109618 and CVE-2026-109619, which CISA added to its Known Exploited Vulnerabilities catalog on 2026-10-26. Belden says all versions of NetModule NRSW, the router software of the Bern-headquartered NetModule AG, are affected with no patched release and advises disabling the web interface; macmon 6.x and 7.x, Schneider Electric Security Expert and Control Engineering, B&R APROL, HMS Netbiter, Wibu-Systems CodeMeter License Central and Oracle Secure Backup and Solaris 11 carry fixes or remediations at varying stages. →
  2. 02Gheist abuses stolen GitHub tokens to dump secrets through Actions; GitHub's hold covers public repositories only. Wiz Research has tracked since 2026-09-15 an automated campaign, Gheist, that uses stolen GitHub tokens to commit a secret-dumping Actions workflow to every repository each token can reach, more than 13,500 branches from more than 850 accounts. GitHub's approval hold of 2026-07-28 stops the workflow on public github.com repositories, but not on private repositories or GitHub Enterprise Server, where Wiz saw the runs complete and the organizations' own workflows assume AWS roles on the attacker branches. →
  3. 03Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link not vendor-confirmed. TCS Camping is warning about 15,000 guests after data was stolen at Camping.Care, the Dutch supplier of the booking system for all TCS campsites; TCS confirmed the theft to SRF on 2026-10-26, SRF reports it in connection with the PHP security hole and Blick says the attackers used the two critical PHP flaws, though no source names a CVE or the entry point. Names, telephone numbers and reservation numbers are already used in fraudulent WhatsApp messages; TCS says account and IBAN data were not affected and the hole is closed. A second customer, Campingplatz Hüttenberg in canton Thurgau, has warned its guests of the same fraud in a notice that says Camping.care is still investigating the cause and does not mention PHP. →

01Active threats, incidents & disclosures2 items

NOTABLEupdatedNATOB2

Camping.Care booking system (TCS Camping): customer and booking data stolen in connection with the PHP flaws, with real reservation numbers already used in WhatsApp fraud and 15,000 guests warned as a precaution

TCS Camping is warning about 15,000 guests as a precaution because the provider of its booking system, Camping.Care, suffered a data theft; TCS confirmed to the SRF consumer programme Espresso on 2026-10-26 that fraudsters could steal customer and booking information, and SRF reports the case in connection with the worldwide PHP security hole (SRF, 2026-10-26). Blick describes Camping.Care as a Dutch company whose booking system handles reservations for all campsites of the Touring Club Schweiz, writes, citing SRF, that the hackers used the critical PHP flaw to steal customer and booking data and that Camping.Care is not the only software supplier hit (Blick, 2026-10-26). No source names the CVE identifiers, the entry point, the date of the intrusion or an actor, and TCS says the hole has since been closed (SRF, 2026-10-26). The stolen data already in criminal use includes, among other data, names, telephone numbers and reservation numbers: guests received fraudulent WhatsApp messages that refer to existing reservations (SRF, 2026-10-26). TCS says account details and IBANs were not affected and that credit card data is not stored in the booking system (SRF, 2026-10-26). A second customer, Campingplatz Hüttenberg in canton Thurgau, told its guests in a notice (page date 2026-10-23) that Camping.care had informed it of WhatsApp messages to guests of several campsites that contain real booking information and a link, that Camping.care is investigating the cause and that booking data must be assumed to have been used without authorisation; the notice does not mention PHP, and Netzwoche points out that it does not say whether the attackers used one of the PHP flaws (Campingplatz Hüttenberg, 2026-10-23; Netzwoche, 2026-10-27).

Triage: TCS Camping sends no automated booking details, payment requests or reservation links over WhatsApp, so a WhatsApp message of that kind that quotes a genuine reservation is the fraud, however accurate its details (SRF, 2026-10-26).

As TCS confirms to the SRF consumer magazine Espresso, fraudsters were able to steal customer and booking information. (translated from German)

The security hole has meanwhile been closed. (translated from German)

SRF (Espresso) 2026-10-26

The hackers used the critical security hole in the PHP programming language to steal customer and booking data (translated from German)

Blick 2026-10-26

Camping.care is currently investigating the cause of the incident. (translated from German)

As things stand, it must be assumed that booking data was used without authorisation. (translated from German)

Campingplatz Hüttenberg (guest notice, page date 2026-10-23) 2026-10-23

Whether the attackers in the Camping.care incident actually exploited one of the PHP vulnerabilities is not apparent from the campsite's notice. (translated from German)

Netzwoche 2026-10-27

Fraudsters were able to steal customer and booking information in connection with the international security hole in the PHP programming language, as a spokesperson of the Touring Club Schweiz (TCS) confirmed on Monday at the request of the news agency Keystone-SDA (translated from German)

watson.ch (Keystone-SDA dispatch) 2026-10-26
Updaterun 2026-10-28T0256Z-intelheadlinesummarysourcesevidencesourcing_notebody

Netzwoche reported on 2026-10-27 that a second Swiss Camping.Care customer, Campingplatz Hüttenberg in canton Thurgau, has warned its guests of WhatsApp messages about existing bookings that contain real booking information and a link; the campsite's notice carries the page date 2026-10-23 (Netzwoche, 2026-10-27; Campingplatz Hüttenberg, 2026-10-23). The notice says Camping.care informed the campsite of the messages, that Camping.care is investigating the cause and that booking data must be assumed to have been used without authorisation; it does not mention PHP, and Netzwoche points out that it does not say whether the attackers used one of the PHP flaws. The link to the PHP flaws therefore rests on SRF, Blick and a TCS spokesperson's statement to Keystone-SDA (watson.ch, 2026-10-26), not on the supplier.

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the…

incident27 Oct 03:53Zsingle-source · victim disclosureOpen finding →
Sources: SRF (Espresso) · Blick · CISA (alert, updated 2026-10-26) · Campingplatz Hüttenberg (guest notice, page date 2026-10-23) · Netzwoche · watson.ch (Keystone-SDA dispatch)
NOTABLENATOB2

Gheist: stolen GitHub tokens plant a secret-dumping workflow in every repository they reach; GitHub's July approval hold stops it on public github.com repositories but not on private ones or GitHub Enterprise Server

Wiz Research has tracked since 2026-09-15 a campaign it calls Gheist, after the user agent on its API calls, that uses stolen GitHub access tokens to create a branch and commit a workflow named sync-check in every repository each token can reach: more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to private enterprise repositories (Wiz, 2026-10-25). Wiz traces the tokens to infostealer logs and earlier supply-chain compromises (Wiz, 2026-10-25). The push triggers the workflow, which prints the repository's secrets, and those of any deployment environment, into its own run log; GitHub masks secret values only when they appear verbatim, so a base32-encoded value prints in full, the tool downloads the log through the GitHub API and deletes the run seconds later, and because the secrets leave through GitHub's own API there is no attacker domain or connection to block (Wiz, 2026-10-25). In enterprise organizations the tool cycled through the tokens of several users and automation accounts within minutes and cloned private repositories before planting the workflow; hours later cloud credentials from the same organization were used to enumerate AWS Secrets Manager (Wiz, 2026-10-25). Around 2026-10-19 the second variant added a job for repositories with a self-hosted runner that searches the host, and through the Docker socket its root filesystem, for tokens, private keys, environment files and Terraform state; Wiz calls the job buggy (Wiz, 2026-10-25).

Since 2026-07-28 GitHub holds potentially malicious workflow runs in public repositories until a collaborator approves them, and every public Gheist run Wiz checked stayed held; the hold applies to public repositories on github.com only and not to GitHub Enterprise Server (Wiz, 2026-10-25; GitHub, 2026-07-28). In private repositories and GitHub Enterprise environments Wiz saw runs on the attacker branches complete and be deleted, and cloud audit logs showed the organizations' own workflows running on those branches and assuming AWS roles (Wiz, 2026-10-25). As of 2026-10-24 Wiz called the attack ongoing and distinct from the earlier GhostAction campaign (Wiz, 2026-10-25).

Triage: the planted commit is unsigned but authored as the token's owner, so the author name alone proves nothing; one new workflow file with a fixed commit message on a branch the owner did not create is the pattern (Wiz, 2026-10-25).

We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories.

GitHub masks secret values in logs only when they appear verbatim.

Unfortunately, that hold doesn't apply to private repositories or GitHub Enterprise Server.

Wiz Research 2026-10-25

This protection currently applies to public repositories on github.com only.

GitHub (changelog) 2026-07-28

Builds on: GhostAction: fake security workflows now harvest whole git histories; rotating Actions secrets…

threat27 Oct 03:54Zsingle-sourceOpen finding →
Sources: Wiz Research · GitHub (changelog)
NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, PHP2Shell in industrial, building and network-access products: Belden NetModule NRSW has no fix and macmon 6.x must move to 7.x, with notices from Schneider Electric, B&R, HMS Networks, Wibu-Systems, Johnson Controls and Oracle

Industrial, building and network-access vendors have published their own notices for the PHP runtime flaws CVE-2026-109618 and CVE-2026-109619, which CISA lists as exploited since 2026-10-26 (CISA KEV, 2026-10-26). Belden says all versions of NetModule NRSW, including the latest mainline release 5.0.0.104, are affected and that no patched release exists; until one ships it advises disabling the web interface after confirming SSH access, with the CLI settings http.status=0 and https.status=0 (Belden, 2026-10-22). NetModule AG is headquartered in Bern, Switzerland (Belden, 2022-03-14). Belden's macmon 6.x and 7.x use PHP in the web interface: a patch for 7.x is in the service portal, 6.x must move to 7.x, and the HTTPS web interface and guest portal must not be reachable from the internet unprotected (Belden, 2026-10-22).

Schneider Electric lists EcoStruxure Security Expert (fixed in 1.48.4.0), ProLeiT LINEoptimize (remediation through ProLeiT support) and EcoStruxure Control Engineering, where its revision of 2026-10-26 gives an automatic update if the hosting virtual machine can reach the debian.org and sury.org repositories and a Schneider patch otherwise (Schneider Electric, 2026-10-26; SecurityWeek, 2026-10-26). B&R says APROL up to R 4.4-65 is affected, with patches planned for 2026-10-26 and 2026-10-29 (B&R, 2026-10-23). HMS Networks says Netbiter firmware up to 3.00.10 can be exploited from the LAN or the USB port and that 3.00.11 fixes it (HMS Networks, 2026-10-23). Wibu-Systems lists the web interface of CodeMeter License Central and its extensions, with 5.2.2 released and a patch installer for 5.1.2 and 5.0.x (Wibu-Systems, 2026-10-23). Johnson Controls has released patches for several Illustra product lines and fixed Visonic PowerManage in 5.0.45 (SecurityWeek, 2026-10-26). Oracle's Security Alert, revised on 2026-10-26, patches Oracle Secure Backup 19.1.0.0.0 to 19.1.0.1.0, Oracle Solaris 11 and eight Oracle Communications products for CVE-2026-109618 (CVSS 3.1 9.8) and says it will extend the alert as more patches become available (Oracle, 2026-10-26).

including the latest mainline release 5.0.0.104.

Belden (security advisory PSIRT-10) 2026-10-22

said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released.

SecurityWeek (relaying Belden PSIRT-10)

Customers can obtain the patched Security Expert version 1.48.4.0 from Schneider’s Customer Care Center

SecurityWeek (relaying SESB-2026-295-01)

said its APROL process control system is affected in versions up to R 4.4-65. Patches were expected on October 26 and October 29.

SecurityWeek (relaying B&R SA26P015)

Remote code execution without authentication is possible.

HMS Networks (security advisory HMSSAR-2026-10-22-002) 2026-10-23

Rev 2. Added Oracle Secure Backup

Oracle (Security Alert Advisory, Rev 2) 2026-10-26

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 14… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and…

vulnerability27 Oct 03:56Zmulti-sourceOpen finding →
Sources: Belden (security advisory PSIRT-10) · Schneider Electric (security bulletin SESB-2026-295-01, version 2.0.0) · B&R (cyber security advisory SA26P015) · HMS Networks (security advisory HMSSAR-2026-10-22-002) · Wibu-Systems (product alert, CodeMeter License Central PHP vulnerabilities) · Oracle (Security Alert Advisory, Rev 2) · SecurityWeek · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · Belden (acquisition of NetModule AG)

03Updates to prior coverage8 items

HIGHCVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; fourteen hotfixes are out and six are due by 2026-10-30

First published 2026-10-22 · open finding →

Updaterun 2026-10-27T0256Z-intelactionsbodycvesevidenceheadlinesourcessourcing_notesummarytagstitle

Palo Alto Networks now records eleven PAN-OS hotfixes as released (10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.2.10-h16, 12.1.7-h11 and 12.2.4-h1) with nine others due by 2026-10-30; CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, while Palo Alto still reports no malicious exploitation against its products.

Palo Alto Networks' advisory now records eleven PAN-OS hotfixes as released: 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 (revision of 2026-10-25), 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 (2026-10-26), and 10.2.13-h27, 10.2.16-h12, 12.1.7-h11 and 12.2.4-h1 (2026-10-27) (Palo Alto Networks, 2026-10-27). Nine hotfixes still carry estimated dates from 2026-10-27 to 2026-10-30, among them 12.1.4-h13, 12.1.10-h3 and four 11.2 lines, and the FAQ says 11.2.10-h16 carries only the PHP fix while 11.2.10-h17 carries the PHP and the Brotli fixes (Palo Alto Networks, 2026-10-27). Palo Alto still says it is not aware of malicious exploitation of this issue against its products (Palo Alto Networks, 2026-10-27). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, as the PHP flaws themselves rather than as a PAN-OS finding (CISA KEV, 2026-10-26).

Sources: Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) · Palo Alto Networks PSIRT (advisory, revised 2026-10-23) · Palo Alto Networks PSIRT (advisory, revised 2026-10-24) · Palo Alto Networks PSIRT (advisory, revised 2026-10-25) · Palo Alto Networks PSIRT (advisory record with revision history) · Palo Alto Networks PSIRT (advisory, revised 2026-10-27) · Palo Alto Networks PSIRT (advisory record with revision history, 2026-10-27) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · Palo Alto Networks Unit 42 (threat brief, revised 2026-10-25) · PHP (security advisory) · Palo Alto Networks PSIRT (advisory, as read on 2026-10-28) · Palo Alto Networks PSIRT (advisory, Internet Archive copy of 2026-10-27 17:10 UTC) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.27) · Palo Alto Networks PSIRT (advisory record with revision history, as read on 2026-10-28)
CRITICALCVE-2026-109618 +1exploitedupdatedNATOA1

CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)

First published 2026-10-21 · open finding →

Updaterun 2026-10-27T0256Z-intelbodycvesevidenceheadlineimmediate_actionsourcessourcing_notesummarytags

CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 after a honeypot operator documented the first successful code execution (35 shells on three PHP 8.4.26 mod_php targets); no source ties a named CVE to a production compromise. VulnCheck's exploit now also covers PHP 8.2 and 8.3 builds on mod_php, and SRF links a data theft at TCS Camping's booking-system supplier to the PHP flaw; the entry's earlier statements that neither flaw was listed and that no source reported successful exploitation are replaced.

CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 and updated its alert the same day, which still tells operators to patch internet-facing systems first, to take PHP-based systems offline where they cannot be patched or run PHP 8.1 or earlier, and to monitor for PHP worker processes launching shells or downloading tools (CISA, 2026-10-26; CISA KEV, 2026-10-26). The listing follows a honeypot report by Adel Karimi of Perplexity dated 2026-10-24, relayed by SecurityWeek and BleepingComputer on 2026-10-26, that documents the first successful code execution: 35 execution-stage requests against three honeypots running PHP 8.4.26 under single-worker mod_php, each followed by a shell started directly by an Apache worker, consistent with CVE-2026-109618 and not establishing a separate CVE-2026-109619 path (Karimi, 2026-10-24; SecurityWeek, 2026-10-26; BleepingComputer, 2026-10-26). It is honeypot evidence: no second-stage download was observed, Karimi says it does not measure exploit reliability on other worker counts, PHP builds or applications, and no source ties a named CVE to a production compromise; Unit 42's retraction of 2026-10-25 stands. Expel's Marcus Hutchins calls it by far the highest-quality confirmation of in-the-wild exploitation he has seen (BleepingComputer, 2026-10-26).

VulnCheck's page, updated as of 2026-10-26, extends its working exploit to mod_php on PHP 8.2.28 to 8.2.34 and 8.3.22 to 8.3.35 as well as 8.4.10 to 8.4.26 and 8.5.10 to 8.5.11 (VulnCheck, 2026-10-26). In Switzerland, SRF reports on 2026-10-26 that TCS Camping is warning about 15,000 customers because data was stolen at its booking-system supplier Camping.Care in connection with the PHP flaw: names, telephone numbers and reservation numbers were used in fraudulent WhatsApp messages, and TCS says account and IBAN data were not affected; neither SRF nor TCS names a CVE or the entry point (SRF, 2026-10-26).

Sources: PHP (php.net news archive, Upcoming Critical PHP Security Release) · CERT-EU (Security Advisory 2026-018) · Sansec · Wordfence · PHP (php.net news archive, Security advisory: Critical remote code execution vulnerabilities, update now) · PHP (GitHub security advisory, CVE-2026-109618) · PHP (GitHub security advisory, CVE-2026-109619) · PHP Foundation · Cloudflare · watchTowr (vulnerability FAQ) · VulnCheck · Security.nl · CISA Known Exploited Vulnerabilities catalog (version 2026.10.23) · Palo Alto Networks PSIRT (advisory) · Palo Alto Networks Unit 42 (threat brief, retraction of 2026-10-25) · The Hacker News (PHP2Shell exploitation report relaying the retracted account) · PHP (php.net news archive, Informational advisory: Session upload progress) · The Hacker News · CrowdStrike · Sophos (PHP2Shell advisory, correction of 2026-10-22) · Wordfence (attacks continue, no known compromises) · SANS Internet Storm Center (diary 33452) · BACS (Federal Office for Cybersecurity, warning) · ENISA (joint statement with the European Commission, CERT-EU, Europol EC3 and the CSIRTs network) · Canton of Basel-Stadt (communiqué, via nau.ch) · nau.ch (Keystone-SDA) · RTS · Publica (status page) · Inside IT · SRF · watson.ch (Keystone-SDA) · UKAuthority · The Register · Red Hat (CVE page) · Fortinet PSIRT (FG-IR-26-186) · Splunk (SVD-2026-1013) · WatchGuard PSIRT (WGSA-2026-0032) · NetScaler Product Security (Citrix Tech Zone) · Cisco PSIRT (cisco-sa-php-october26-Jj384Daq) · Tenable (TNS-2026-30, Security Center patch SC-202610.2) · Tenable (TNS-2026-31, Enclave Security patch SC-202610.2) · Siemens ProductCERT (SSA-566512) · ReliaQuest Threat Research · Cisco PSIRT (cisco-sa-php-october26-Jj384Daq, version 1.7) · Fortinet PSIRT (FG-IR-26-186, revised 2026-10-26) · Splunk (SVD-2026-1013, updated 2026-10-26) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · CISA (alert, updated 2026-10-26) · Adel Karimi (Perplexity), honeypot-data report · SecurityWeek · BleepingComputer · VulnCheck (blog, updated 2026-10-26) · Palo Alto Networks PSIRT (advisory, revised 2026-10-27) · Palo Alto Networks PSIRT (advisory, as read on 2026-10-28) · Palo Alto Networks PSIRT (advisory, Internet Archive copy of 2026-10-27 17:10 UTC) · SRF (Espresso) · Blick
HIGHexploitedupdatedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two

First published 2026-10-18 · open finding →

Improvementrun 2026-10-27T0256Z-intelevidencesourcessourcing_note

Huntress's analysis of 2026-10-26 reads the activity as scripted tooling steered by an operator, rates LLM involvement low to medium on its own telemetry, adds a detection for service principals that assign themselves or a sibling a directory role, and notes that Graph reads leave no Entra audit record.

Huntress published its analysis of what drove the 2026-10-15 activity on 2026-10-26, working from Entra sign-in and directory audit logs in the tenants it monitors. It says its telemetry aligns with Microsoft's Storm-0940 and ARTEX account without independently confirming it, that it is highly confident an operator, a person or an LLM, adapted the tooling between runs, and that its confidence that an LLM was involved in the escalation tooling is low to medium on its own telemetry and medium to high once Microsoft's attribution is included (Huntress, 2026-10-26). Its evidence for adaptation: a certificate upload that failed on a thumbprint mismatch ended one run with no retry, and the next run 55 seconds later retried the same error with growing waits until it worked; in a second tenant that refused removal of the Global Administrator role, the actor granted a different role to a sibling principal and the original service principal was then deleted (Huntress, 2026-10-26). Microsoft Graph reads are not recorded in the Entra audit log and no victim Huntress knows of had Graph activity logging enabled, so a clean audit log does not show that no Graph access took place (Huntress, 2026-10-26). Huntress recommends alerting when a service principal assigns itself Global Administrator or Privileged Role Administrator, deletes itself, or when one vendor principal grants a role to a sibling, and turning on Graph activity logs where licensing allows (Huntress, 2026-10-26).

Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer · SpecterOps · Sophos X-Ops · Microsoft Threat Intelligence · Expel · heise online · Huntress (AI, Scripts, Operator: Inside the ConnectWise Attack)
NOTABLEupdatedNATOB2

ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration

First published 2026-10-22 · open finding →

Updaterun 2026-10-27T0256Z-intelevidencesourcessourcing_notesummary

Seoul police referred the leader of a criminal group to prosecutors on 2026-10-23 for stealing 8.2 million records from more than 90 organizations, hospitals and universities among them, and extorting 38; BleepingComputer reports that the group used ARTEX, so the framework is now documented in criminal extortion use as well as in Storm-0940's state-aligned activity.

Seoul Metropolitan Police announced on 2026-10-26 that it referred a 32-year-old gang leader to prosecutors on 2026-10-23, with six accomplices investigated without detention, for taking 8.2 million personal-data records and internal files from more than 90 organizations since September 2025, among them cram schools, hospitals, golf courses, universities and large-company affiliates, and for sending extortion e-mails (Yonhap, 2026-10-26, translated from Korean). BleepingComputer, citing local media, reports that the group demanded 360 million won (about USD 270,000) in 38 of the incidents in exchange for not leaking the data, that the police say the leader used the ARTEX framework, the same system used in the attacks on South Korean banks, and that he moved from conventional tools to AI utilities in late August 2026 (BleepingComputer, 2026-10-26). Yonhap counts 60 of the victims as hacked with AI and describes the system as the AI autonomous penetration-testing system used in the recent financial-sector data thefts without naming it, so the ARTEX name is BleepingComputer's (Yonhap, 2026-10-26). No encryption step is reported, and the police say AI lowered the barrier to entry and call this the first arrest in Korea in a large-scale hacking and personal-data theft case that exploited generative AI (BleepingComputer, 2026-10-26). The framework is therefore in use by a financially motivated criminal group as well as by the state-aligned actor Microsoft describes; no source reports a Swiss victim.

Sources: Microsoft Threat Intelligence · Expel · CrowdStrike Counter Adversary Operations · Recorded Future Insikt Group · Wiz Research · BleepingComputer · Yonhap News Agency
HIGHCVE-2026-86950exploitedupdatedNATOA2

CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)

First published 2026-09-30 · open finding →

Updaterun 2026-10-27T0256Z-intelactionsbodycvesevidenceheadlinesourcessummary

Apple's iOS and iPadOS 18.7.11 of 2026-10-26 deliver the CVE-2026-86950 fix to iPhone XS, XS Max, XR and iPad 7th generation, four weeks after the 26.7.1 releases that did not list those devices; the flaw remains exploited against targeted individuals and KEV-listed.

Apple's security content for iOS 18.7.11 and iPadOS 18.7.11, released 2026-10-26, lists CVE-2026-86950 as fixed for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation, among other devices, and repeats Apple's statement that it is aware of a report of exploitation in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 (Apple, 2026-10-26). The notes for iOS and iPadOS 26.7.1 of 2026-09-28 list the fix for iPhone 11 and later and for iPad models from the iPad 8th generation, and the CISA catalog record for the flaw names no other Apple document, so in the documents these sources name the fix reaches those four device families four weeks after the others (Apple, 2026-09-28; CISA, 2026-09-29). SANS Internet Storm Center says this round delivers the corresponding iOS 18 patches for a flaw patched a month earlier and that no new vulnerability is marked as already exploited (SANS ISC, 2026-10-27).

Sources: Apple Security (iOS 26.7.1 and iPadOS 26.7.1) · Apple Security (iOS 18.7.11 and iPadOS 18.7.11) · SANS Internet Storm Center (Apple October 2026 updates) · Apple Security (macOS Tahoe 26.7.1) · Apple Security (macOS Sequoia 15.8.1) · CISA Known Exploited Vulnerabilities Catalog · ENISA EU Vulnerability Database · SecurityWeek · The Hacker News
HIGHCVE-2026-111497exploitedupdatedNATOA1

CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)

First published 2026-10-24 · open finding →

Updaterun 2026-10-27T0256Z-intelactionsaffected_productsbodycvesentitiesevidenceheadlinesourcessummarytags

NCSC Switzerland rates exploitation of the Brotli flaw unknown with a proof of concept available and names rejecting Content-Encoding: br as the interim measure; Palo Alto lists PAN-OS 12.2, 12.1 and 11.2 firewalls that inspect Brotli traffic with TLS decryption enabled (hotfixes due by 2026-10-30), and PHP for Windows and Ubuntu shipped fixes. Still no source reports exploitation outside Imperva's laboratory demonstration.

NCSC Switzerland (BACS) published advisory 13105 on 2026-10-26 on the Brotli decoder flaw: it names Node.js, Microsoft .NET, Visual Studio, PowerShell, the Python Brotli and brotlicffi packages and Bun among the affected dependents, rates the current exploitation status unknown with a proof of concept available, and gives as the temporary measure disabling Brotli decoding of untrusted data and rejecting Content-Encoding: br until patched, with services restarted and containers rebuilt after updating (NCSC Switzerland, 2026-10-26).

Palo Alto Networks lists PAN-OS 12.2 before 12.2.4-h1, 12.1 before 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, and 11.2 before 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1 as affected, but only on PA-Series and VM-Series firewalls that have inspection of Brotli-compressed traffic and TLS decryption enabled on the dataplane; PAN-OS 11.1 and 10.2 and the management interface are not affected, and the hotfixes carry estimated dates from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-26). Brotli encoding is disabled by default in PAN-OS 11.2.4 and later, the command show system setting brotli shows whether a firewall is exposed (Enabled: yes), and set system setting brotli-encoding disable is the vendor's interim mitigation; Palo Alto rates the urgency moderate and is not aware of malicious exploitation (Palo Alto Networks, 2026-10-26).

PHP rebuilt its Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on 2026-10-26 with Brotli 1.2.1; the vulnerable decoder is reachable there through the cURL extension when automatic HTTP response decompression is enabled, which cURL leaves off by default (PHP, 2026-10-26). Ubuntu lists brotli fixes for 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1), marks 20.04 LTS as needing evaluation and its nodejs package on 20.04, which vendors Brotli, as vulnerable (Ubuntu, 2026-10-26).

Sources: Node.js project · Node.js project (release v22.23.4) · Node.js project (release v24.22.1) · Node.js project (release v26.12.1) · Google Brotli · ENISA EUVD · Imperva Threat Research · OpenSourceMalware · Envoy Proxy (security advisory) · .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory) · NCSC Switzerland (BACS, Cyber Security Hub advisory 13105) · Palo Alto Networks PSIRT (CVE-2026-111497 portfolio status) · PHP (news archive, updated Windows builds for the Brotli fix) · Ubuntu Security (CVE-2026-111497) · CISA (alert, KEV additions) · ELLIO Threat Research Lab · Tenable Research · JFrog Security Research · Akamai Security Intelligence Group · Cisco PSIRT (advisory, Vulnerabilities in node.js Affecting Cisco Products) · Palo Alto Networks PSIRT (CVE-2026-111497 portfolio status, as read on 2026-10-28)
NOTABLECVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, QVR Surveillance and TVR OS now fixed, Notes Station 3 and QNE (ADRA) still unfixed

First published 2026-10-25 · open finding →

Updaterun 2026-10-27T0256Z-intelactionsbodycvesevidenceheadlinesourcessourcing_notesummarytagstitleaffected_productsentities

QNAP's advisory table now lists QVR Surveillance (ARM32) 3.0.3.1756 and TVR OS 1.0.5 as resolved, leaving Notes Station 3 and QNE (ADRA) without a fix, and no longer names QuMagie as affected; CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26.

As of 2026-10-27 QNAP's advisory table lists QVR Surveillance 3.0.3 and earlier (ARM32 models) as resolved by QVR Surveillance 3.0.3.1756 and TVR OS 1.0.4 and earlier as resolved by TVR OS 1.0.5, while Notes Station 3 3.9.14 and earlier and QNE (ADRA) 1.0.7 and earlier remain in "Fixing" with the fixed version to be announced; QuMagie is no longer among the listed affected products, and the revision history still ends at V1.1 of 2026-10-24, so these table changes carry no dated revision (QNAP, 2026-10-27). QNAP still says it has received no reports of exploitation targeting QNAP products (QNAP, 2026-10-27). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, as flaws in PHP rather than as a QNAP finding (CISA KEV, 2026-10-26).

Sources: QNAP PSIRT (QSA-26-18, revision V1.1) · QNAP PSIRT (QSA-26-18, affected-products table as of 2026-10-27) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · QNAP (statement on PHP2Shell) · Synology PSIRT (Synology-SA-26:14)
NOTABLECVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, NetScaler ADC and Gateway: the PHP2Shell flaws reach the management GUI on the NSIP, management-enabled SNIPs and the cluster IP of every supported version; fixed in 14.1-73.49, 13.1-64.32 and the FIPS and NDcPP builds

First published 2026-10-23 · open finding →

Updaterun 2026-10-27T0256Z-intelcvesevidenceheadlinesourcessourcing_notesummarytags

CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26; no source reports an attack on NetScaler, and Citrix's bulletin still names no fixed build, so restricting management access remains the control.

CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, as flaws in PHP rather than as a NetScaler finding (CISA KEV, 2026-10-26). No source reports an attack on NetScaler through them. Citrix's bulletin CTX697263, whose revision history ends on 2026-10-22, still lists NetScaler ADC and Gateway as impacted, points to the Tech Zone post for mitigation and names no fixed build (Citrix, 2026-10-22), so the management-interface restriction stays the control until Citrix lists a fixed build.

Sources: NetScaler Product Security (Citrix Tech Zone) · Citrix security bulletin CTX697263 · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · CERT-FR

04Action items10 items

Verification & coverage notes1 run

2026-10-27T0256Z-intel · Sonnet 5.5 · window 26 h · 3 entries published

Verification & coverage notes

Window of 26 h (gap 24.0 h) on a Tuesday with one dominant story: CISA's KEV listing of the PHP2Shell flaws on 2026-10-26 and the first documented code execution against honeypots. The container clock agreed with the network date (skew 0 s); the previous fire (2026-10-26T0256Z-intel, publish ok) was on origin/main. A container restart at about 03:13Z killed the first four research sub-agents before any returned; they were re-spawned once at 03:15Z (their progress and checkpoint files are kept as *.attempt1.* under work/<run-id>/, used as leads only) and all four returned by 03:35Z, so the restart cost about eighteen minutes and no entry depends on the lost work.

  • Published (new, three): the TCS Camping and Camping.Care booking-data theft that SRF and Blick tie to the PHP flaws (notable, PD-11(c): the first Swiss-linked victim report of the exploited PHP flaws, a supplier-borne exposure with a transferable lesson for public bodies whose portals run on PHP suppliers; single-source-victim, TCS's own confirmation, B2); Wiz Research's Gheist campaign, stolen GitHub tokens planting secret-dumping workflows, with GitHub's own changelog confirming that its approval hold covers public repositories on github.com only (notable, PD-11(a) and (d)); and a PHP2Shell vendor-notice entry for industrial, building and network-access products, led by NetModule NRSW (router software of the Bern-headquartered NetModule AG, all versions, no fix, web interface to be disabled) and macmon 6.x/7.x, with Schneider Electric, B&R, HMS, Wibu-Systems, Johnson Controls and Oracle (notable, PD-11(b): no fix and an out-of-band response on an exploit-listed flaw; one entry per estate class as for QNAP and Synology, not one per vendor).
  • Updated (eight changelog records): the main PHP2Shell entry (update: KEV listing and Karimi's honeypot report; the statements that neither flaw is in KEV and that no source ties a confirmed compromise to the flaws were replaced where they stood, the 2026-10-26 section's sentence was narrowed to production systems, the main analysis was held at its previous 1,977 words); PAN-OS (update: nine hotfixes released, one action added); NetScaler (update: KEV listing, no fixed build in Citrix's bulletin); QNAP (update: QVR Surveillance and TVR OS resolved, QuMagie no longer listed); the Brotli entry (update: NCSC.ch advisory 13105, PAN-OS firewalls with Brotli inspection and decryption, PHP for Windows, Ubuntu; one action added); Apple CVE-2026-86950 (update: iOS 18.7.11 fixes iPhone XS, XS Max, XR and iPad 7th generation); ARTEX (update: Seoul police arrest of a criminal group's leader, BleepingComputer names the framework); ConnectWise Cloud Backup (improvement: Huntress's analysis, detections and the Graph logging gap).
  • KEV sweep: CVE-2026-109618 and CVE-2026-109619 (COVERED-STALE on four store entries) are dispositioned by the four updates above plus the new vendor-notice entry; no NOT COVERED or MENTION-ONLY row and no RANSOMWARE row (CISA marks ransomware use unknown). The KEV remediation deadline is not carried in any entry.
  • Backlog: the ARX Group SA row stays held, unchanged and unappended: S4 re-checked it and the ransomware.live record still shows no press link, with no ARX, SBB or ASTRA/USTRA statement and no Swiss press report; the 2026-11-07 expiry stands.
  • Single-source: gheist-stolen-github-tokens-secret-dumping-workflows (Wiz telemetry, B2), original lab research; pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (vendor's own product, A).
  • borderline-drop: PK Softech and Publica, EDÖB head Lobsiger's SonntagsBlick interview relayed by Inside IT and Ticinonline (2026-10-25 and 26) and Publica's re-stated "no darkweb publication", a conditional possible widening of the proceeding, a re-confirmed status and a breach-notification count; the entry already carries the formal investigation (S2 and S4, same drop as the previous fire).
  • borderline-drop: Medienwerkstatt Sulgen TG (Akira claim, victim confirms ransomware and copied data), private print firm, no public-sector customer stated, no vector or behaviour beyond the impact (incident floor), the only link is the actor already in the Publica entry; University of Copenhagen test-environment breach, out of nexus, no vector.
  • borderline-drop: Cisco Talos on attackers using 25+ legitimate platforms to mail the lure under the brand's own DKIM and DMARC (2026-10-21, first coverage from a rotational lookback), drafted as an entry and dropped after the first verifier pass: six-day-old vendor research with a vendor tally and consumer-retail examples, the lesson is a generic gateway-inspection point and a Tier 2/3 responder changes nothing in the next seven days because of it (PD-11, awareness only).
  • borderline-drop: Arctic Wolf Labs on more than 400 Teams external-chat helpdesk-impersonation cases (2026-10-26); the store carries six Teams-vishing entries and three already carry the external-access allow-list lever; the new content is one audit event name (ChatCreated) and a tenant-pattern description.
  • borderline-drop: CYFIRMA's PHP2Shell advisory (Lazarus-ecosystem actor, 216 hosts, closed I2P channel), single vendor, nobody can check the channel, confidence inconsistent between narrative and evaluation, no Swiss nexus (dropped by the previous fire too); Symantec's AI-honeypot "Skynet" capture and Semperis on Prince of Persia (both lookback), relevant only to bodies that expose model endpoints or indicator-led infrastructure tracking with no European case; Forever Security's planted AGENTS.md (2026-10-22), vendor-run reproduction, success rates are the vendor's claims, delivery of the file unknown.
  • out-of-window: CrowdStrike's report on four actors running Claude Code as an intrusion operator (2026-10-23, recovered through a Hacker News recap of 2026-10-26; the crowdstrike record was not in any slice), primary source three days before the window start and not a rotational lookback; offered to the audit.
  • borderline-drop: Risikomonitor's Swiss unpatched-domain figures (Inside IT, 2026-10-26); scope differs from the 2026-10-22 figure so it is not a trend; Fortinet FG-IR-26-186 and -187 revisions, Synology Hyper Backup "not affected", NetScaler Product Security (no new post readable), Tailscale "Tailworm", Wasmtime sandbox escapes, Chromium Mobile rows in MSRC, Sansec Magecart items, Plex and EG SiteGuard KEV additions (2026-10-20, out of window, consumer or Japan-specific), no delta for the reader or out of scope.
  • Contradiction: S1, S2 and S3 each framed the KEV listing and the honeypot report as separate items; they were merged into one update. S2 read CISA's due date of 2026-10-29 as a signal; it is a US federal obligation and is not carried (PD-13). The Phase 4 re-fetch of two pages read with guessed URL slugs returned 404 (corrected to the URLs in the findings; nothing was cited from a guessed URL).
  • Contradiction: the Palo Alto Brotli advisory (CVE-2026-111497) still shows 12.2.4-h1 and 12.1.7-h11 with 10/28 estimated dates while the PHP2Shell advisory, revised at 2026-10-27T04:03Z, lists both as released; the Brotli entry cites the Brotli advisory as stated and the PAN-OS entry the PHP2Shell one.
  • Candidate sources added: belden-psirt (first-party NetModule and macmon advisories, on no slice source) and karimi-honeypot-data (packet-level exploitation ground truth). Not added: arctic-wolf-labs (its item was dropped), forever-security (no feed, vendor interest) and hacksnack-ch (derivative SME news, offered by S2 and S4). Recipe notes from the source ledgers were appended to the matching sources/sources.json records, among them the BACS card-markup change that breaks the documented split, the Fortinet RSS reset, the SSD Disclosure recipe and the Help Net Security extract behaviour.
  • Reader credit: extract fell through to the metered reader for the CISA alert, the QNAP page and the Dark Reading articles; S4 reported two more on tcs.ch and news.ku.dk.
  • Audit hand-offs: the IDC Frontier entry does not cite the provider's sixth report of 2026-10-18; Eichstätt (Germany, municipal ransomware through an unnamed third-party vulnerability despite two-factor authentication, statements of 2026-10-22 and 23) fell about twelve hours outside the lookback and is a municipal lesson; the main PHP2Shell entry's main analysis (1,977 words) and several others touched this fire remain over the 550-word bound as carried debt, none grown by this fire.
  • Coverage gaps: connectwise-trust-center (403 on every transport, failing on every run since 2026-10-19); ec-digital-strategy-newsroom (403 on every transport); community.citrix.com Tech Zone NetScaler post (403 on every transport for S1; a later extract read it, last updated 2026-10-22 and still saying fixes are planned for 2026-10-27, so whether they shipped is unconfirmed); rapid7 and cisa.gov all.xml discovery feeds (unreadable); lumen-black-lotus-labs (landing page without a post listing); php.risikomonitor.com (figures render client-side).
  • Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0
  • Essential-coverage: all 21 essential records of S1 and S2 were attempted; none missed.