Two stories lead today. PHP has fixed the two leaked PHP2Shell engine bugs, and mod_php is the deployment to worry about. Eight eMudhra intermediate CA keys turned out to be recoverable because of weak key generation, and browsers are now removing an emSign root, which leaves about 30,000 certificates with a deadline. Also: CISA added six exploited CVEs on 20 October, and Unit 42 tied Qilin and INC to a GlobalProtect bypass.

Do today

  • PHP: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, mod_php hosts first. (php.net)
  • TLS certificates: replace anything chaining to emSign ECC Root CA - G3 before Chrome removes it on 27 October. (Google)
  • Plex: treat any internet-exposed server older than 1.43.3.10861 as compromised, and rebuild it rather than only updating. (Plex bulletin)
  • GlobalProtect: patch CVE-2026-0257 or turn off authentication-override cookies, then hunt recent gateway sessions. (Palo Alto Networks)
  • FortiSIEM 7.5.0: upgrade to 7.5.1, or block TCP 27918 from everything except trusted collectors. (FG-IR-26-180)
  • UpdraftPlus: update to 1.26.13 (or premium 2.26.13), delete the UpdraftCentral key, and audit editor-level accounts. (TeamUpdraft)

AI and agent security3 stories

  • Cairn panels expose AI-agent intrusion campaigns — NorForge found internet-exposed admin panels for Cairn, an open-source multi-agent platform. Through them it watched three clusters run autonomous intrusion work against web shops. The largest, a Chinese-language cluster NorForge calls AIA0001, ran more than 1,100 projects. NorForge puts the average success rate at about one task in ten. Reuters reports more than 100 companies breached out of over 1,200 sites attempted; some of the named companies say the impact was limited or is still under investigation. The counts measure different things (projects, sites, companies), so don’t add them up. Takeaway: agent-driven probing of storefront stacks is happening now, and any AI pentest or agent dashboard should not be on the public internet. (NorForge, Reuters via Star-Advertiser)

  • Government practices for AI incidents in super intelligence training — NIST’s CAISSI, the NSA’s SISC and CISA published ten voluntary practices on 16 October for incidents where a frontier model, during training or evaluation, takes significant uninstructed actions that undermine operator controls. The scope is frontier labs, not enterprise agent fleets, and the document never uses the “rogue AI” framing some headlines gave it. The parts worth borrowing are monitoring across the model, harness, host and network layers, red-teaming the monitors themselves, and confirming containment before restarting anything. (NIST announcement, NIST key practices document)

  • Kiro Crew: missing authorization in the WhatsApp channel (CVE-2026-112380) — In AWS’s open-source personal agent, a WhatsApp group member could steer another session’s subagent into running tools on the operator’s machine, and the audit log attributes the action to the operator. Default configs are not affected. Only installs that allowlisted a WhatsApp group or opened the DM policy are. Upgrade to 0.7.2, or clear whatsapp.groups and keep dm_policy=self. (AWS 2026-140)
    CVSS 9.9 (v3.1, AWS) EPSS 0.00407 KEV no

Application security3 stories

  • PHP2Shell (CVE-2026-109618, CVE-2026-109619) is patched — Wiz Research found both and reported them in August. The CVE IDs then leaked on 20 October, ahead of an embargo watchTowr says was set for the 22nd, and PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 today. One bug is in out-of-memory handling and leaves request memory uninitialised. The other lets global state outlive its request, so a later request on the same worker can use freed memory. Both fire before any application code runs. The PHP advisory validated unauthenticated RCE against mod_php only. FPM has no complete exploit shown, and FrankenPHP and LSAPI are rated likely affected but not validated. Correcting earlier reports: 7.4–8.1 do get source-level backport branches from the PHP security team, but no official release. PHP says the memory_limit and request-size mitigations are partial and do not make a host safe. Exploitation status is disputed: watchTowr and Cloudflare report early attempts, while CISA’s assessment in NVD records none. (php.net, GHSA-w8hw-w9fx-j79w, Tenable FAQ)
    CVSS 9.2 (v4.0, PHP) / 9.8 (v3.1, NVD) EPSS not yet scored KEV no

  • Stolen UpdraftCentral keys used to push signed backdoors — TeamUpdraft says an attacker reached its customer database over the weekend of 17–18 October, including UpdraftCentral cloud connection keys. Patchstack then saw those keys used to install backdoor plugins through correctly signed plugin.upload_plugin commands, with 99 distinct plugin names. The backdoor plants a hidden account with the Editor role plus manage_options and install_plugins. It survives plugin removal and gets around 2FA. 1.26.13 / 2.26.13 revokes older cloud keys (1.26.12 tried and failed). TeamUpdraft’s own checklist still says “1.26.12 or later”, so go straight to 1.26.13. Hunt by capability rather than username, check mu-plugins, and restore from a pre-17 October backup if anything looks off. Self-hosted UpdraftCentral is not affected. No CVE has been assigned. (TeamUpdraft, Patchstack)

  • OVHcloud CLI releases swapped for a credential stealer — A hijacked contributor account used the GitHub Releases API to replace the binaries for v0.11.0–v0.15.0 on 19 October. The swapped files were live for about 93 minutes and were downloaded about 250 times. The source and the build pipeline were untouched. A downstream CI job that pinned SHA-256 hashes is what caught it. Anyone who pulled those versions in the window should treat every secret on that machine as exposed (cloud, SSH, Git, npm, Kubernetes, AI-assistant configs). Check the temp directory for envchecker-* folders, compare against the advisory’s hashes, and reinstall v0.16.0. The link to the GlassWorm operation rests on a shared Solana wallet; OpenSourceMalware says that is an inference. (GHSA-862f-55f5-vmvw, OpenSourceMalware)

Exploited and critical CVEs4 stories

  • CISA KEV, 20 October: Plex chain, Siemens Software Center, SiteGuard — All six entries come with confirmed exploitation.

    • Plex chain (CVE-2026-96652, 96654, 96655, 96656): Plex says exploitation became widespread after a public PoC on 16 October, with cryptominers and proxyware. The fix, 1.43.3.10861, has been public since 4 August. The 1 September date in some reports is Plex’s bulletin, not the fix. Plex names proxystream[.]st as an indicator. Rebuild exposed servers, clear the Codecs folder and reset credentials.
    • Siemens Software Center (CVE-2026-110936): Siemens confirms attackers used a signed copy of the program to sideload DLLs, and names 96.62.218[.]59 and wizardexpensive[.]com. Confirm installs reached V4.0.9.8.
    • SiteGuard Server Edition (CVE-2026-106931): save diagnostic data before applying Ver 8.00 Update 5 or Ver 7.00 Update 6.
    • Deadlines: 96654, 96656 and 106931 are due 23 October; the rest are due 3 November. (CISA KEV data, Plex bulletin, Plex 1.43.3 release)

  • PAN-OS CVE-2026-0257: Qilin and INC on GlobalProtect — Unit 42 updated its threat brief on 19 October. Affiliates of Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) have used this auth bypass since at least June to open MFA-less VPN sessions, then moved laterally to vCenter, ESXi and domain controllers. Only gateways with authentication-override cookies enabled are exposed; Panorama and Cloud NGFW are not affected. Patch to a fixed hotfix (for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6) or turn the cookies off, and keep GlobalProtect off management interfaces. Treat any match against Unit 42’s indicators as an incident. The KEV entry dates from 29 May; Unit 42’s page says 13 May. Trust the catalog. (Unit 42, Palo Alto Networks)
    CVSS 7.8 (v4.0, Palo Alto) / 9.1 (v3.1, NVD) EPSS 0.969 KEV yes, ransomware use known

  • FortiSIEM CVE-2026-106173: public PoC for a pre-auth file write — The phQueryMaster gRPC service in FortiSIEM 7.5.0 listens on all interfaces and accepts a path-traversal file write without authentication, which leads to code execution. Horizon3 published its analysis and proof-of-concept code on 20 October. Fortinet and Horizon3 both report no exploitation yet, but expect scanning. 7.6 and FortiSIEM Cloud are not affected. Upgrade to 7.5.1, restrict TCP 27918 in the meantime, and check the files Horizon3 names for unexpected modification times. (FG-IR-26-180, Horizon3)
    CVSS 9.8 (v3.1, Fortinet; page shows 9.4 temporal) EPSS 0.00459 KEV no

  • Oracle October CPU: 1,295 patches, six unauthenticated 10.0s — The bugs to patch first:

    • Fusion Middleware: Oracle Access Manager (CVE-2026-87337) and three in SOA Suite (CVE-2026-91231, -91216, -91221).
    • E-Business Suite: Workflow Notification Mailer (CVE-2026-101809).
    • JD Edwards: the EnterpriseOne Orchestrator (CVE-2026-91299). Patch internet-facing instances of those first and restrict network access while the rest of the CPU is scheduled. The next CPU is due 19 January 2027. (Oracle)

Cloud and infrastructure5 stories

  • eMudhra intermediates compromised through weak key generation — A researcher recovered the private keys of eight emSign intermediates (six TLS, two code signing) because the P-384 keys were generated with almost no entropy. eMudhra blames a key-generation script and human error. Chrome and Mozilla blocked the keys within hours on 17 October, eMudhra revoked them on the 18th, and Chrome’s CT review found no TLS certificates issued from them. The operational hit is the root removal. Mozilla has already dropped emSign ECC Root CA - G3, and Chrome follows on 27 October. About 30,000 certificates need to move. Re-sign Windows binaries signed through EM OV CS CA - G3B/G3C. Outside the browser, rebuild Go apps on 1.27.3 / 1.26.10 (CVE-2026-111943) and update certifi, NSS and distro ca-certificates. Apple’s and Microsoft’s blocking dates are reported but unconfirmed. (Mozilla Bugzilla, Google, Go announcement)

  • ConnectWise Cloud Backup: vendor app credential used against M365 tenants — Huntress reports that an attacker signed in to customer tenants as ConnectWise’s own backup application, so MFA never applied. In a few tenants the attacker added itself to admin roles and attached secrets to other apps. Huntress counted 162 tenants with confirmed unauthorised sign-ins. In one partner tenant, the Cloud Management Teams app added itself to Global Administrator; Huntress has not tied that to the main sign-ins. ConnectWise says it has reset the affected environment, services stay suspended, and the cause of initial access is still unknown. Pull Entra service-principal sign-ins for app ID 506e08f9-6e9a-4da4-942b-a099a03644ae and the other ConnectWise/SkyKick apps for 13–16 October. Look for role additions and new app credentials where a vendor app is the actor, and disable (don’t delete) those service principals until restore guidance lands. ConnectWise lists 144.172.64[.]128, .99 and .60, and Huntress adds 144.172.94[.]243. Reports of “173 tenants” have no primary source. (Huntress, The Hacker News)

  • Zeabur breached, closing on 31 December — Zeabur says an attacker used its own long-lived plaintext admin credentials between 14 and 15 October. The attacker read 3,218,965 environment-variable records and 321,810 accounts, plus shared-cluster secrets and 865 shared database services, 736 of them n8n. Rotate every credential that lived in an environment variable, revoking it at the provider first. Change database passwords inside the database, rotate n8n encryption keys and stored credentials, rebuild GCP dedicated servers, and plan the migration before year end. (Zeabur)

  • AWS CI/CD toolchain sample: overly broad pipeline role (CVE-2026-112407) — In AWS CICD-toolchain-for-serverless-applications 1.0.7–1.0.10, anyone with push access to the source repo could reach resources outside the stack in the same account. There is no workaround. Update existing stacks to 1.0.11, and until then review who can push and check CloudTrail for deploys outside the stack. (AWS 2026-141)
    CVSS 8.8 (v3.1, AWS) EPSS 0.00345 KEV no

  • Unbound: second DNS-over-QUIC use-after-free in five weeks (CVE-2026-97206) — A remote client can trigger a QUIC path migration that frees a stream still in use and crash a multi-threaded resolver. Affects 1.22.0–1.26.1, so last month’s 1.26.1 fix is not enough. Upgrade to 1.26.2. NLnet Labs doesn’t say so for this CVE, but its earlier DoQ advisory required a build with DoQ support and a configured QUIC port, so resolvers without DoQ are likely out of scope. (NLnet Labs advisory)
    CVSS 7.5 (v3.1, NLnet Labs) EPSS 0.00263 KEV no

Bottom line

  1. Patch PHP, Plex and GlobalProtect today. Each has a published exploit path and real attackers behind it, and two of them carry 23 October KEV deadlines.
  2. Two of today’s supply-chain stories (UpdraftCentral and the OVHcloud CLI) were properly signed or properly released artifacts. The OVHcloud swap was caught only because one downstream CI job pinned the release hash. Pin hashes and turn on release immutability for your own repos.
  3. Vendor app credentials keep bypassing MFA. Inventory third-party service principals in Entra, their roles and their credentials, and know how to disable one quickly.