Skip to content
feed: live
0dayNews
Briefing · 2026-10-20 to 2026-10-26

Week in Review: Oct 20-26, 2026

PHP2Shell dual-RCE KEV confirmations and government breach; BlackX Secure Boot bypass; Cisco/Arista/Atlassian October patches; Operation Serengeti III.

tldr.txt
  • PHP2Shell (CVE-2026-109618, CVE-2026-109619): two critical RCEs confirmed exploited in the wild, both added to the CISA KEV catalog. PHP patched October 21. A confirmed government network breach involved PHP2Shell-derived access plus AI-assisted post-exploit tooling. A separate unpatched PHP RCE (non-default config) was disclosed October 24 with no fix available.
  • October patch batch: Cisco dropped 34 CVEs with six critical (IOS XE, Nexus Dashboard, collaboration platforms). Arista VeloCloud CVE-2026-114625 is a zero-day under confirmed active exploitation with a federal remediation deadline of October 26. Atlassian's October bulletin covers 75 vulnerabilities, 14 critical, across Jira, Confluence, and Bitbucket.
  • BlackX: a UEFI bootkit attributed to APT41 by the disclosing researchers bypasses Secure Boot on fully patched Windows 11 systems. No patch available as of October 25. Microsoft is investigating; CISA and Microsoft have not confirmed attribution.
  • Operation Serengeti III: Interpol announced 1,462 arrests across 19 African nations October 22, targeting business email compromise and cybercrime infrastructure. Quest Diagnostics disclosed a patient data breach via the Quanum platform. SafePay ransomware: FBI and CISA joint advisory cites 600-plus critical infrastructure victims.
  • AI-assisted ransomware confirmed in INC and Gentlemen intrusions. Brotli decoder RCE confirmed in Node.js, Bun, and Python. F5 NGINX out-of-band patches for three CVSS 8.1 flaws. vLLM CVE-2026-116177 unauthenticated memory exhaustion patched in 0.25.0. Postiz CVSS 9.9 token confusion flaw patched.

PHP2Shell: two critical RCEs, confirmed exploitation

CVE-2026-109618 and CVE-2026-109619 are both on the CISA KEV catalog. PHP patched both October 21. Active exploitation confirmed before the patch shipped.

One confirmed government network breach involved PHP2Shell-derived access. Post-exploitation tooling included AI-assisted automation. Attribution to a specific threat actor is not stated in CISA’s advisory.

Separately: PHP warned October 24 of an unpatched RCE in non-default configurations. No patch. No exploitation confirmed as of October 24. The flaw is distinct from PHP2Shell.

October patch batch: Cisco, Arista, Atlassian

Cisco October advisory: 34 CVEs, six critical. IOS XE, Nexus Dashboard, and collaboration platforms.

Arista VeloCloud CVE-2026-114625: zero-day, confirmed active exploitation, CISA KEV-listed with a federal remediation deadline of October 26. That deadline is today.

Atlassian October bulletin: 75 vulnerabilities, 14 critical, across Jira, Confluence, and Bitbucket.

BlackX: UEFI bootkit, Secure Boot bypass

BlackX is a UEFI bootkit that bypasses Secure Boot on fully patched Windows 11 systems. Active as of October 25. No patch available. Microsoft is investigating.

Attribution to APT41 is assessed by the disclosing researchers. CISA and Microsoft have not confirmed attribution.

Operations and arrests

Operation Serengeti III: 1,462 arrests across 19 African nations. Interpol reported October 22, targeting business email compromise and cybercrime infrastructure.

Quest Diagnostics breach: patient data exposed via the Quanum platform. Scope and notification timeline in the linked coverage.

Ransomware

SafePay: FBI and CISA joint advisory cites 600-plus critical infrastructure victims across U.S. sectors.

AI-assisted ransomware: INC and Gentlemen ransomware intrusions used autonomous AI agents for portions of the intrusion and exfiltration workflow. Confirmed by researcher analysis of post-incident forensics.

Also this week

Postiz CVE-2026-115933: CVSS 9.9, token confusion flaw in the social media management platform. Patched.

F5 NGINX out-of-band patches: three flaws at CVSS 8.1 covering HTTP/3 and map directive handling in NGINX Plus, Open Source, and Ingress Controller. No exploitation confirmed.

Brotli decoder/Node2Shell: RCE confirmed in Node.js, Bun, and Python via a Brotli decoder flaw.

vLLM CVE-2026-116177: CVSS 7.5, unauthenticated memory exhaustion via the Nemotron-VL processor. Patched in 0.25.0.

Storm-0940/Artex: confirmed targeting of ConnectWise Cloud Backup with AI-assisted techniques.

Sources