Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
Microsoft acknowledged that the October 2026 Windows 11 cumulative updates did not fix a known bug affecting Always On VPN connections. The issue causes VPN connections to remain stuck in a connecting state or fail, sometimes showing an error about ports already in use. Microsoft mistakenly marked the bug as resolved in October but reverted it to mitigated status, promising a fix in a future update. A temporary workaround involves configuring Always On VPN to use a single tunneling protocol (SSTP or IKEv2) instead of automatic protocol selection.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
Between April and July 2026, AOMEI Backupper, a Windows backup and disk cloning software, was compromised multiple times in short-lived supply chain attack windows. During these brief periods, users received a downloader for the ShinyRoad modular backdoor framework. The attacker, tracked as UNC7017, tampered with update server configurations to redirect users to malicious payloads, including the CrossRoad dropper, a modified Radmin Server with a malicious DLL, and the Adaptix C2 framework. The campaign used ephemeral tampering windows lasting only five to ten minutes, reverting quickly to authentic versions, which complicated detection. The attack affected a broad range of users opportunistically, with some higher education, IT services, and telecommunications organizations in multiple countries identified as compromised. AOMEI initially dismissed reports of tampering but later took corrective actions after repeated notifications.
Microsoft announced that Windows Server 2025 now supports quick machine recovery following the installation of the October 2026 security update. This update introduces a new feature aimed at improving recovery times for machines running this server version.
A vulnerability in Siemens Software Center allowed attackers to pair a legitimate signed copy of the software with malicious DLLs to infect Windows PCs. The flaw, CVE-2026-110936, involves improper DLL search path restrictions, enabling local authenticated attackers to execute arbitrary code with Software Center privileges. Siemens released version 4.0.9.8 to fix the issue, with automatic updates for existing users. The attacks are linked to the Romulus ClickFix malware campaign, which uses social engineering to trick users into executing malicious commands. Siemens confirmed no breach of their distribution channels and is sharing threat intelligence with authorities and security vendors.
Microsoft fixed a bug in the September 2026 Windows 11 preview update (KB5124010) that caused crashes in games and apps using AC-3 (Dolby Digital) audio decoding. The issue affected applications that rely on Windows' built-in audio decoding for AC-3, causing them to fail to launch or crash during audio playback. The problem was resolved in the October 2026 Patch Tuesday update (KB5127648), which is recommended for affected Windows 11 24H2 and later systems.
Microsoft fixed a bug in the classic Outlook desktop client for Windows that caused the Copilot Chat and Copilot buttons to be missing for some users. The issue was due to Outlook failing to retrieve certain account information from the user's profile. The missing buttons affected users with valid Copilot licenses, preventing access to Copilot features in classic Outlook, though Copilot remained accessible via Outlook on the web and the standalone Copilot app. Microsoft provided a workaround involving enabling the "Show Apps in Outlook" setting and recommended using the new Outlook client or creating a new profile if the issue persisted. The bug was resolved with an update after resurfacing following recent changes.
Microsoft's October Windows Server security updates have been confirmed to cause issues with Outlook Web Access (OWA) sign-in and mail delivery on some Exchange Server systems. This disruption affects the normal operation of Exchange Server mail flow and user access via OWA.
Microsoft's October 2026 Windows 11 update KB5127648 may cause issues for some users attempting to enable Smart App Control. This problem affects the ability to turn on this security feature after applying the update.
KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.
Microsoft announced that Windows Server 2022 reached the end of mainstream support as of October 13, 2026. The product will continue to receive extended support, including security updates, until October 14, 2031. Hotpatching support for the Datacenter: Azure Edition will continue until October 2027. Microsoft recommends upgrading to Windows Server 2025, which offers full mainstream support and will be supported until November 2034. This announcement also includes related end-of-support notices for Windows 11 versions.
Microsoft fixed a known issue causing black screens, desktop loading problems, and Windows Explorer crashes after installing Windows 11 updates released since August 2026. The problem primarily affected Azure Virtual Desktop hosts using FSLogix for profile management. Microsoft released cumulative updates on October 13, 2026, that resolve the issue. A temporary workaround involves manually launching Windows Explorer via Task Manager. Enterprise customers can also apply Known Issue Rollback group policies to mitigate the problem until the update is installed.
Microsoft addressed a known issue affecting Always On VPN connections that occurred after installing the September 2026 Windows 11 security updates. The problem caused VPN connectivity disruptions but has since been resolved by Microsoft.
Recent Windows updates may cause Remote Desktop connection failures for non-admin users when the "Administrator protection" security feature is enabled. Microsoft has confirmed this issue but no specific vulnerability or exploit details are provided.
Microsoft's October 2026 Patch Tuesday includes security updates addressing 1415 vulnerabilities across multiple products, with 85 marked as critical. Among these, 67 are remote code execution vulnerabilities. One vulnerability, CVE-2026-96951, a security feature bypass in Windows Shell involving command injection, has been exploited in the wild. Other notable vulnerabilities affect Windows Active Directory Domain Services, Microsoft Exchange Server, Windows Hyper-V, Microsoft Office Excel, Microsoft QUIC, and various Windows components. The vulnerabilities have CVSS base scores ranging from 7.0 to 9.8, indicating high severity. Microsoft has released patches for these issues as part of the monthly update cycle.
Microsoft has released the Windows 10 KB5126657 extended security update as part of the October 2026 Patch Tuesday. This update includes multiple security fixes and some bug fixes and changes. No specific vulnerabilities or exploits are detailed in the provided information.
Microsoft has announced that Windows 11 version 24H2 Home and Pro editions have reached end of support as of October 13, 2026. These editions will no longer receive monthly security or non-security updates, including protections against the latest security threats. Users are advised to upgrade to Windows 11 version 26H2, which is currently rolling out and will be supported until October 2029. Enterprise and Education editions of Windows 11 24H2 remain supported until October 12, 2027. The end of support means devices running these Home and Pro editions will not receive further security patches, potentially increasing exposure to vulnerabilities if not upgraded.
Microsoft released cumulative updates KB5127648 and KB5126653 for Windows 11 versions 23H2, 24H2, 25H2, and 26H2. These updates include the October 2026 Patch Tuesday security patches addressing hundreds of vulnerabilities, along with various bug fixes and new features such as emoji updates, File Explorer improvements, Bluetooth enhancements, and accessibility features. The updates are mandatory and unify fixes across the supported Windows 11 versions.
Attackers continue to exploit gaps in multi-factor authentication (MFA) coverage by using stolen credentials to access VPNs, RDP, and Windows systems that rely solely on passwords. The issue highlights that protecting only cloud applications is insufficient, and organizations need to address authentication weaknesses across all access points to prevent unauthorized access.
