CISA added both PHP2Shell CVEs to the Known Exploited Vulnerabilities catalog on Monday evening and gave federal agencies until Thursday, 29 October, to patch. It did so while public evidence of successful attacks is still contested. MeshCentral’s maintainers say an active exploit is taking over servers and the clients connected to them. Apple has brought its exploited CoreGraphics fix to iPhones that can’t run iOS 26, and HashiCorp, Mautic and Supermicro all published critical fixes on the same day.

Do today

  • PHP: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 before the 29 October KEV deadline. Take PHP 8.1 and older offline if you can’t upgrade, and watch for PHP workers spawning shells. (CISA alert)
  • MeshCentral: upgrade to 1.3.1 now, then review server accounts, device groups and recent agent activity, because the maintainers report an active takeover exploit. (MeshCentral 1.3.1 release)
  • Apple: put iPhone XS, XR and the listed older iPads on iOS/iPadOS 18.7.11, and roll out macOS 27.2 for the remote code execution fix in Remote Management. (Apple security releases)
  • HashiCorp Consul: if you use consul-k8s with manageSystemACLs=true, move to 2.1.0 or 1.8.18. Move Consul servers to 2.1.0 (Enterprise 2.1.0 or 1.21.19). (HCSEC-2026-50)
  • Supermicro BMCs: keep IPMI/RMCP+ on an isolated management network, and schedule the per-board BMC firmware updates. (Supermicro advisory)
  • Mautic 7: upgrade to 7.2.2, or restrict campaign-import permission to trusted admins and block script execution in media/. (GHSA-mxjf-pghx-h299)

AI and agent security5 stories

  • Compaction smuggling: OpenAI’s compaction endpoint leaked hidden reasoning — Xint showed that OpenAI’s conversation-compaction step could be told to copy a model’s encrypted reasoning out in plain text. A different model then repeated that text back. This got around the cross-model replay block OpenAI added in August, because compaction runs on the same model that produced the reasoning. OpenAI confirmed the issue, deployed an undisclosed server-side fix on 23 October and paid a $6,000 bounty. API users don’t need to change anything. Xint is clear about the limits: it couldn’t prove the output matched the reasoning word for word, it reached only reasoning from its own requests, and it tested one model. Our take: this is a distillation and IP-protection issue rather than a customer-data leak. The broader point is that any server-side step that decrypts hidden state and then follows user instructions can leak it. (Xint write-up)
  • CrowdStrike: four unreported actors ran intrusions through agent harnesses — CrowdStrike recovered offensive agent frameworks from exposed open directories belonging to four previously unreported actors, active between May and August. One operator ran two Claude Code agents in a supervisor/executor loop built on PentestGPT against at least 15 Argentine healthcare entities. A Chinese-speaking operator reached Claude through a China-based proxy service and targeted government and private-sector organisations. An Indonesian-speaking actor leaned on about 819 public skills, and a Russian-speaking group packed a seven-step intrusion, exfiltration included, into one slash command. CrowdStrike assesses with moderate confidence that agentic tooling makes basic intrusions available to more people, often reaching their objectives within an hour. Our take: none of the four needed new tradecraft. Fast, noisy, by-the-book intrusions are exactly what detection on standard post-exploitation behaviour already catches, so tune for speed. (CrowdStrike report)
  • Mistral Vibe: a malicious repository runs commands before the trust prompt (CVE-2026-116843) — In worktree mode, Mistral’s coding agent ran git worktree add before checking whether the folder was trusted. That let a repository’s own git filter drivers run attacker commands as the user. Version 3.0.3, released 26 October, also stops repository-configured core.fsmonitor and signature-verification programs from running during file completion and project-context loading. It adds an outside_workdir = "deny" setting as well. Our take: this is the same class of bug that keeps recurring in coding agents, where git configuration executes before the trust boundary is checked. Treat any tool that opens untrusted repositories as code execution. (Mistral Vibe 3.0.3 release, NVD record)
    CVSS 8.8 (v3.1, VulnCheck) EPSS not yet scored KEV no
  • vLLM: images labelled PNG could reach Ghostscript (CVE-2026-115915) — vLLM’s image loader passed request bytes to Pillow’s format autodetection without an allowlist, so a file declared as PNG could be decoded as EPS. On hosts whose Ghostscript is still vulnerable to CVE-2024-29510, that could mean command execution as the vLLM user. Pillow 12.0.0–12.2.0 adds a worker-exhaustion bug on the same path. The reporter confirmed execution at the loader level but didn’t test the full HTTP path. Upgrade to 0.32.0, and keep Ghostscript off inference images unless you need it. (GHSA-h3rc-j82p-2c3h)
    CVSS 8.1 (v3.1, GitHub) EPSS not yet scored KEV no
  • Anthropic: models map unintended pre-authentication attack surface in 25 projects — Anthropic had Claude inventory more than 17,000 configuration options across 25 open-source projects. It reports 493 issues, including 93 unnecessary pre-authentication surfaces in default configurations and 94 option combinations that silently disabled a security control. One case was a client-certificate check dropped by an option conflict that had existed for 21 years. In OpenSSH, roughly 4,500 lines of experimental ML-DSA-44 code were reachable before authentication in default sshd, and the fix shipped in 10.6. Our take: these are vendor-reported numbers, not independently reproduced. The useful lesson is the method: audit what a default build exposes before login, not only whether the code is memory-safe. (Anthropic research)

Application security6 stories

  • Microsoft Authenticator for Android: any installed app could request work tokens (CVE-2026-80097) — Enclave’s 23 October write-up explains a bug Microsoft fixed in September. An exported account-chooser activity trusted the identity a calling app claimed for itself, so a malicious app could pass as Teams and obtain Microsoft Graph tokens for the signed-in work account. Versions before 6.2606.4246 are affected. The sources disagree on one point: Microsoft’s vector requires user interaction, but Enclave says its proof of concept needed nothing beyond a signed-in account. Neither says whether updating revokes tokens an app has already taken. Our take: make sure MDM enforces the fixed version, and treat Graph sign-ins from Authenticator’s broker on unmanaged devices as worth a look. (Enclave write-up, NVD record)
    CVSS 8.6 (v3.1, Microsoft) EPSS 0.0044 KEV no
  • OAuthLib: a made-up device code returns a bearer token (CVE-2026-49272) — OAuthLib 3.3.0 up to 4.0.0 never validated the device_code parameter in the RFC 8628 device-authorization grant. Anyone who knows a client ID enabled for device flow could get a token. The fix in 4.0.0 adds a validate_device_code hook to the request validator, so applications must implement it. If you run a Python authorisation server with device flow, upgrade and check that your validator actually implements the new method. (GHSA-3jp2-3mrg-2vxc)
    CVSS 8.5 (v3.1, GitHub) EPSS not yet scored KEV no
  • Mautic 7: campaign import drops scripts into the web root (CVE-2026-115188) — Any user allowed to create campaign imports, not only administrators, could upload arbitrary files into a public media directory. On Apache setups that honour per-directory configuration, including the official Docker image, that means code execution as the web server. Versions 7.0.0 to before 7.2.2 are affected, and 6.x and earlier are not. There’s no official workaround. The advisory suggests limiting the import permission and blocking script execution in media/. (GHSA-mxjf-pghx-h299)
    CVSS 9.9 (v3.1, Mautic) EPSS not yet scored KEV no
  • Qode Membership for WordPress: log in as any user (CVE-2026-92885) — Wordfence reports that a typo in the plugin’s Facebook OAuth check turned token verification into dead code. An unauthenticated attacker who supplies a username and a nonce from a public login or register page can sign in as that user, including an admin. NVD lists versions up to 2.0.6.2 as affected. We couldn’t confirm a fixed version. If the plugin is bundled with your theme and you don’t use its social login, remove it or take the login and registration shortcodes off public pages. (NVD record)
    CVSS 9.8 (v3.1, Wordfence) EPSS not yet scored KEV no
  • Apple 27.2 releases: 286 fixes, including remote code execution in macOS Remote Management (CVE-2026-112427) — Apple shipped iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari updates on 26 October. The macOS Golden Gate 27.2 notes list an authentication-state bug in Remote Management that lets a remote attacker run code. They also list a Kerberos KDC impersonation issue (CVE-2026-112518) and several remotely triggerable Screen Sharing and SMB crashes. Apple notes no exploitation for any of these. Patch Macs that have Remote Management or Screen Sharing turned on first. (macOS Golden Gate 27.2 notes, Apple security releases)
    CVSS 8.1 (v3.1, CNA) EPSS not yet scored KEV no
  • PHP2Shell reaches OT and building systems — Industrial vendors are now publishing their own PHP2Shell assessments. Schneider Electric lists three affected products and a fix for EcoStruxure Security Expert (1.48.4.0). Belden says every NetModule NRSW version is affected with no patch yet and recommends disabling the web interface. Siemens points Ruggedcom APE1808 owners to Palo Alto’s PAN-OS workarounds. Johnson Controls has shipped Illustra and PowerManage fixes, while Rockwell and Hitachi Energy are still investigating. Our take: embedded PHP is where patching will lag the longest. Hold these devices to “management interface unreachable from untrusted networks” until each vendor ships firmware. (Schneider SESB-2026-295-01, Siemens SSA-566512, Belden PSIRT notice)

Exploited and critical CVEs5 stories

  • PHP2Shell is now in KEV, due 29 October (CVE-2026-109618, CVE-2026-109619) — CISA added both flaws on 26 October and updated its PHP alert. It tells organisations to find every PHP install, including copies bundled inside other products, and to take PHP 8.1 and older offline if it can’t be patched. A WAF may help only as a stopgap. CISA hasn’t said what exploitation it saw. The Record reports CISA’s position that KEV’s standard covers attempted as well as successful exploitation. Public evidence is mixed: a honeypot operator documented working shells, covered here yesterday, but Sophos withdrew its own success claim on 22 October after finding only scanning and failed attempts. Our take: the debate over whether real compromises have happened doesn’t change the deadline. With EPSS near 1.0 and a KEV listing, patch internet-facing PHP this week. (CISA KEV addition, CISA PHP alert, Sophos correction, The Record)
    CVSS 9.8 (v3.1, NVD) CVSS 9.2 (v4.0, PHP) EPSS 0.9998 KEV yes, due 29 Oct
  • MeshCentral 1.3.1: emergency fix for an active takeover exploit — MeshCentral’s maintainers released 1.3.1 on 23 October and urge everyone to upgrade. They say an active exploit gives attackers control of the server and every connected remote client. They also say only that the release “should hopefully” fix it. There’s no CVE or technical write-up yet. The commit list tightens file-transfer rights, login-token allowlists, recovery-agent commands and recording playback. Our take: a remote-management server controls every machine enrolled in it. Upgrade, then audit admin accounts, device groups, agent installs and outbound connections from the server since mid-October. (MeshCentral 1.3.1 release)
    CVE not assigned KEV no
  • Apple backports the exploited CoreGraphics fix to iOS 18 (CVE-2026-86950) — Apple’s 26 October iOS and iPadOS 18.7.11 update brings the CoreGraphics out-of-bounds write fix to iPhone XS, XS Max and XR, and to the iPad 7th generation and the other listed older models. Apple first fixed this zero-day in September in the 26.7.1 releases. Apple says it may have been exploited in highly sophisticated, targeted attacks against versions before iOS 27. CISA added the flaw to KEV on 29 September. Our take: older iPhones held by high-risk staff were exposed until this update shipped. Make 18.7.11 mandatory for any that remain in your fleet. (Apple iOS 18.7.11 notes, NVD record)
    CVSS 8.8 (v3.1, CNA) EPSS 0.2617 KEV yes, added 29 Sep
  • Esri ArcGIS Server: SQL injection, anonymous on “public” deployments (CVE-2026-10757) — Esri’s October bulletin covers a SQL injection that lets an authenticated user call database functions they shouldn’t reach. In non-default public configurations, an anonymous user can do the same. Patches exist for 12.1, 12.0, 11.5, 11.3 and 11.1, and older releases must upgrade. NVD’s record conflicts with itself: the description says 12.1 and earlier, while the version data lists 11.1 up to 12.1. CISA’s SSVC entry rates it automatable with no exploitation seen. Our take: GIS servers are often internet-facing for public maps, so patch those first. (NVD record, Esri October 2026 bulletin)
    CVSS 9.8 (v3.1, Esri) EPSS not yet scored KEV no
  • KEV deadlines: Plex SSRFs and Siemens Software Center fall due 3 November — The KEV catalog (version 2026.10.26) still gives agencies until 3 November for the two Plex Media Server SSRF entries from the 20 October batch (CVE-2026-96652, CVE-2026-96655) and for the Siemens Software Center DLL search-path flaw (CVE-2026-110936). The other entries from that batch were due on 23 October. Nothing else besides the PHP pair has been added since 23 October. (CISA KEV feed)
    EPSS 0.0182 / 0.0164 / 0.0097 KEV yes, due 3 Nov

Cloud and infrastructure5 stories

  • HashiCorp Consul: two authorization bypasses (CVE-2026-110720, CVE-2026-105608) — HCSEC-2026-50 says consul-k8s component ACL binding rules didn’t keep authentication inside the Consul namespace. Anyone who can create a ServiceAccount in another namespace and reach the Consul API could authenticate as a Consul component. This affects only deployments with global.acls.manageSystemACLs=true, and the fixes are 2.1.0 and 1.8.18. NVD’s version data, which stops before 2.0.4, doesn’t match the advisory’s 0.42.0 through 2.0.4. Separately, HCSEC-2026-47 shows a user with service write but no mesh write could slip an Envoy escape-hatch override past a key-name check. That could mean code execution in the sidecar, traffic tampering or intention bypass. It’s fixed in Consul 2.1.0 and Enterprise 1.21.19. (HCSEC-2026-50, HCSEC-2026-47)
    CVSS 9.9 / 8.8 (v3.1, HashiCorp) EPSS not yet scored KEV no
  • AWS CDK Redshift constructs: SQL injection runs as superuser at deploy time (CVE-2026-115418) — AWS bulletin 2026-151 says crafted user names, comments or passwords passed to the experimental @aws-cdk/aws-redshift-alpha constructs could change SQL that runs with Redshift superuser rights during deployment. Exploiting it requires influence over construct property values. Upgrade to 2.274.0, patch any forks, and review existing table grants to PUBLIC. Our take: the realistic attacker is someone who can feed values into a pipeline, such as a parameter file or upstream config. That makes this a CI/CD trust issue more than an internet-facing bug. (AWS bulletin 2026-151)
    CVSS not published by AWS KEV no
  • Supermicro BMC: eight flaws across X11–X14 and H11–H14 boards (CVE-2026-18450 and others) — Supermicro’s 26 October advisory credits runZero with eight BMC issues. The worst, rated 9.8, lets IPMI commands run on an active RMCP+ session without integrity or encryption checks. Others include a hardcoded key in the RAKP implementation, a RAKP+ logic flaw that escalates an account to administrator, and admin-to-root paths. Every affected SKU needs a BMC update, and two boards still list the fix as TBD. Supermicro says it knows of no malicious use. Our take: BMCs on routable networks have long been a known risk. Make sure UDP 623 is reachable only from a management segment, then patch. (Supermicro advisory)
    CVSS 9.8 (v3.1, Supermicro) EPSS not yet scored KEV no
  • Google Cloud discloses a fixed Compute Engine disk-exfiltration bug (CVE-2026-85299) — GCP-2026-073, published 26 October, says that before 31 August a user could exfiltrate Compute Engine disk data without the required IAM permissions. Google patched it on its side on 31 August, and customers don’t need to do anything. Google rates it High. Our take: there’s nothing to patch, but if your threat model includes insiders with partial project access, the window before 31 August belongs in any related investigation. (Google Cloud security bulletins)
  • DreamHost forces email and FTP password resets, cause undisclosed — DreamHost’s status page shows File Manager going offline on 23 October and some webmail users being signed out. Precautionary password resets for a subset of email and FTP/SFTP accounts followed. File Manager returned on 26 October and is under monitoring, but DreamHost hasn’t said what happened or how many accounts were reset. Account owners have to pass the reset on to mailbox and FTP users themselves. Our take: until DreamHost explains, treat it as possible credential exposure. Rotate any reused passwords and check for unexpected mail forwarding rules or new files. (DreamHost status)

Crypto and Web33 stories

  • Abracadabra: REKT traces how the MIM peg fund and treasury were emptied — A REKT investigation published on 26 October uses on-chain records to trace events after a June governance vote handed operations to a new steward. The roughly 6 billion SPELL depeg contingency fund moved to custody addresses in June, 8 billion new SPELL were minted and sent toward exchange-attributed wallets, and treasury assets moved out in July. Pharos estimated those July outflows at about $8.3M. The current wind-down proposal claims about $900,000 of collateral against about $22M of MIM held outside protocol addresses, or roughly 4 cents per MIM. REKT itself warns that the outflows don’t reconcile with the wind-down’s figures, and that exchange labels are attributions, not proof of who owns the wallets. Read its conclusions about intent as REKT’s interpretation. (REKT investigation)
  • NovaTech: New York seeks $1.3B from founders who fled the US — New York’s Attorney General asked a court to order NovaTech founders Cynthia and Eddy Petion to pay $1.3B in damages and disgorgement, after a 2025 default judgment. The AG also secured nearly $6M from four promoters, who accepted lifetime industry bans. The AG says investors deposited more than $1B in crypto between 2019 and 2023, but less than $26M was ever traded. Press reports put the total sought at about $1.37B including interest. The AG’s release says $1.3B, and collection is uncertain because the founders left the country. (New York AG release)
  • Coinbase Ireland fined €3.25M over customer-fund safeguarding — The Central Bank of Ireland fined Coinbase Ireland €3,252,618, after a 30% settlement discount, for breaching safeguarding and outsourcing rules under the E-Money Regulations from November 2020 to August 2025. The regulator found heavy reliance on the US group for safeguarding controls, too little local oversight, and a safeguarding account left underfunded for long periods. Coinbase Ireland admitted the breaches, and the High Court still has to confirm the sanction. Press conversions of the fine to dollars vary between $3.6M and $3.65M. (Central Bank of Ireland)

Incidents and industry7 stories

  • UNM Health Sciences Center diverts ambulances after a cyberattack — The University of New Mexico’s health sciences centre detected a cybersecurity event on 26 October. It diverted ambulances, cancelled that day’s clinic appointments and shut down health-school classes for Tuesday. It says the incident is contained, its hospitals are open, clinics resume on 27 October, and state and federal law enforcement are involved. An extortion group called BYOD has claimed the attack on its leak site, including a claim of 36,000 compromised machines. That claim is unverified. (UNM HSC statement)
  • Arctic Wolf: 400+ intrusions began with fake IT support in Teams external chat — Arctic Wolf Labs analysed more than 400 incidents that started with Teams messages from new or purchased Microsoft 365 tenants posing as the help desk, often after the victim’s inbox was flooded with sign-up mail. Between 30% and 40% of the tenants used default onmicrosoft.com domains. Quick Assist was the most common way in, and some cases reached payload execution in under 15 minutes. Our take: turn off external Teams chat or allowlist partner domains, and train staff that real IT support doesn’t cold-message them through external federation. (Arctic Wolf Labs)
  • Hunt.io: lone operator went after Ukraine’s state data-exchange platform — Hunt.io describes a Russian-speaking operator who swept about 9.1 million Ukrainian addresses for hosts tied to the UXP/X-Road data-exchange system. The operator got code execution on at least two hosts. One was a Graylog server holding about 6.8 million documents, compromised with a public Log4Shell-style deserialization chain. Hunt.io recorded queries against the data but no exfiltration, and it stresses that this proves only an absence of evidence. It has not tied the operator to a tracked actor. Our take: logging servers hold everyone’s data, and they’re among the most neglected systems to patch. (Hunt.io report)
  • CISA publishes its 2030 strategy — “CISA 2030: Defend, Harden, Prevail” commits the agency to moving from passive defence toward finding and reducing adversary access to critical infrastructure. Its focus areas are OT, software security, emerging technology and emergency communications. CISA will start reviewing its core services within 60 days, deliver an implementation and measurement plan within 180 days, and report on progress within a year. Our take: the document sets direction but no concrete obligations yet. The 180-day plan is the part to watch. (CISA announcement)
  • Rapid7 Q3: three days from disclosure to exploitation — Rapid7’s Q3 update tracked 43 newly exploited high- and critical-severity vulnerabilities, 34 of which needed no authentication or user interaction. Exploitation came on average three days after disclosure, with 71% within the first week. Only 8% of tracked threat reporting cited AI as an operational component. These are one vendor’s telemetry and tracking choices, but the numbers support treating a KEV listing or public PoC as a reason to patch within days. (Rapid7 Q3 update)
  • Athena StealthRoute: phishing service with AI lure tools and scanner cloaking — Abnormal describes a credits-based phishing-as-a-service platform that hit about 2,280 US and EU organisations over six months ending 9 October. It offers six AI tools for writing lures, decoy pages and paraphrased text, plus a gate that shows benign pages to scanners. Its links imitate SendGrid click tracking but put _upn= in the path instead of the query string, which gives detection a structural tell. Abnormal lists 150.241.88[.]166 among its indicators. (Abnormal research)
  • SiriusQT: a commercial Windows RAT whose licences mostly leaked — Group-IB analysed SiriusQT, sold on dark-web forums since April 2026. It combines hidden VNC, credential and wallet theft, keylogging and custom-encrypted command and control. Group-IB counted at least 30 paying customers, but about 75% of the licences it extracted had leaked. Cracked copies are spreading, delivered as a final stage through the UpCrypter loader. Our take: leaked builds put the tool in many more hands. Detection should key on HVNC behaviour and the loader chain, not on the seller’s builds. (Group-IB analysis)

Bottom line

  1. PHP2Shell is now on a federal three-day clock. Whether or not compromises are confirmed publicly, patch internet-facing PHP, find PHP bundled inside appliances, and take PHP 8.1 and older offline.
  2. Remote-management and out-of-band planes (MeshCentral, Supermicro BMCs, Consul’s control plane) carried this cycle’s highest-impact fixes. Patch them and keep them off untrusted networks.
  3. In AI tooling, the recurring failures are trust boundaries checked too late (Mistral Vibe), format confusion (vLLM) and hidden state leaking through helper steps (OpenAI compaction). Treat an agent that opens untrusted content as running that content’s code.