A Brazilian Magecart group exploited a critical vulnerability (CVE-2026-8467) in Plausible Community Edition versions 3.0.0 through 3.2.0 to inject a card skimmer into the Plausible analytics script used by the Brazilian ecommerce platform Convertr. From October 24 to October 27, 2026, the malicious script stole payment card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers during checkout. The stolen data was exfiltrated to the domain 1x0.is. Convertr removed the skimmer and patched the vulnerability on October 27. This Magecart group has targeted multiple Brazilian ecommerce platforms since 2024 using distinctive data exfiltration techniques.
Since the public disclosure of two critical PHP vulnerabilities on October 21, 2026, exploitation attempts leveraging the PHP2Shell mechanism have been monitored. Although no successful full exploit chains have been observed, private exploits exist and some tools attempt to exploit these vulnerabilities. Challenges such as request-size limits, memory exhaustion, and PHP configuration differences have hindered successful exploitation. Some tools labeled as PHP2Shell exploits actually use unrelated session poisoning techniques requiring separate vulnerabilities. Telemetry indicates a significant reduction in exposed vulnerable machines and affected organizations within one week. Despite limited success so far, PHP2Shell remains a significant security risk requiring immediate attention.
Two unrelated threat operations exploited domain shadowing techniques to insert illegal gambling content under legitimate educational and government domains in Bangladesh, India, and Mexico. Attackers gained unauthorized DNS administration access, creating CNAME records and delegating subzones to third-party nameservers, leveraging institutional domain reputations for search engine optimization. The campaigns affected over 850 entry points across eight domains, primarily hosting gambling pages on Cloudflare Pages. These operations served illegal gambling content targeting Indonesian and Indian markets, exploiting institutional trust to boost search rankings and traffic while leaving primary websites intact and potentially unnoticed by domain owners.
Threat actors are abusing Microsoft Teams' external chat feature to conduct social engineering attacks and deliver malicious payloads. They impersonate IT support using throwaway Microsoft 365 tenants with deceptive display names to bypass warnings. Attacks often start with email bombing, followed by Teams contact offering help, then use legitimate remote access tools to gain control quickly. This technique exploits collaboration features rather than software vulnerabilities.
A Korean-speaking threat actor linked with moderate confidence to North Korea's Lazarus Group is conducting a global campaign exploiting two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. The campaign targets government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across multiple countries including the US, Japan, and EU. Exploitation attempts have been observed since 17 October 2026, involving web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php being at highest risk.
This is a medium-severity phishing campaign observed in late 2026 targeting organizations during year-end and fiscal close periods. Attackers exploit increased legitimate administrative communications in finance, HR, and IT by impersonating compensation adjustments, Q4 financial documents, access reviews, invoice follow-ups, and benefits statements. The campaign uses themes from SharePoint, Docusign, and Microsoft 365 to deliver credential harvesting pages disguised as document-sharing portals. It affects multiple sectors including aviation, telecommunications, manufacturing, real estate, technology, and financial services, with a concentration in the Middle East. The phishing lures are generic and require minimal customization, making them effective during busy periods when employees expect increased document requests.
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.
Between July and September 2026, a sophisticated campaign targeted Microsoft 365 accounts using adversary-in-the-middle attacks and token replay techniques. Attackers captured sign-in sessions via AiTM relays and replayed stolen tokens from IP addresses linked to a German hosting provider. The campaign compromised 79 organizations with 497 successful sign-ins amid over 200,000 failed attempts. Malicious actors registered rogue Entra devices, replaced victim MFA methods, and created hidden inbox rules to conceal their activities. The operation evolved through four phases, rotating IP addresses and employing scripted token and browser session replay techniques. Compromised accounts were used for business email compromise, including sending payroll-related emails to external contacts.
Amazon Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 in MadPot honeypot telemetry on October 17, 2026, four days before their public disclosure. Initial exploitation originated from a commercial anonymization network, indicating threat actor activity during the embargo period. Multiple proof-of-concept exploits with diverse payloads appeared on the disclosure date, suggesting involvement of multiple actors. After the embargo lifted on October 21, exploitation rapidly became widespread. This case highlights the limitations of coordinated vulnerability disclosure and the accelerated timeline for exploit development enabled by AI-assisted analysis.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
Storm-0940, a China-state aligned threat actor, has used the AI-driven ARTEX penetration testing framework since September 2026 to automate large-scale attacks targeting hundreds of organizations globally across multiple industries. These attacks have enabled the actor to gain privileged access to cloud infrastructures rapidly, sometimes within three hours of initial targeting. The actor leveraged ARTEX to accelerate scanning, reconnaissance, password spraying, and OAuth application abuse, notably in the ConnectWise supply chain compromise. The activity involved abuse of Microsoft 365 OAuth applications to access customer environments without interactive user sign-in, followed by reconnaissance and privilege escalation attempts via Microsoft Graph. Microsoft confirmed that these attacks did not stem from vulnerabilities in Microsoft corporate systems or products. Microsoft Defender XDR provides detections and hunting queries to identify suspicious activity related to this threat. Customers are advised to review service principal sign-ins and investigate unexpected credential or privilege changes while following published containment guidance.
The threat actor k0t is conducting a large-scale campaign targeting network edge devices from FortiGate, FortiWeb, and Palo Alto GlobalProtect. The campaign exploits known vulnerabilities CVE-2025-64446 and CVE-2026-0257, combined with brute-force attacks, to harvest over 70,000 credentials globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration using Rclone to cloud storage. Persistence is maintained through tools such as MeshCentral, AdaptixC2, and remote management software like Atera and AnyDesk. The campaign overlaps with ransomware groups Qilin and The Gentlemen, suggesting k0t may act as an Initial Access Broker, though no direct affiliation is confirmed.
A financially motivated threat actor named BUGSTER used jailbroken AI assistants, including the Hermes Agent framework with DeepSeek V4, to conduct multiple cybercrime activities primarily in India and the British Indian Ocean Territory. The actor exploited AI-generated scripts to exfiltrate over 5,200 personal records from a university database, perform WordPress brute force attacks, and plan VoIP telecommunications fraud. Additional malicious activities involved Wi-Fi password cracking requiring physical proximity, cryptocurrency whale reconnaissance, and credential scanning toolkit development. This campaign demonstrates how AI tools can lower the skill barrier for cybercriminal operations.
In October 2026, multiple organizations in Japan suffered unauthorized access incidents leading to personal information leakage. Attackers used artificial intelligence to scan for known vulnerabilities and exploit APIs, including server-side request forgery. They analyzed Android application packages and employed tools to reverse engineer Flutter apps and target various services such as web applications, MySQL databases, Jenkins servers, and email gateways. The attackers attempted to evade endpoint detection and response systems and deployed web shells to gain internal network access. The campaign also affected web services beyond Japan, indicating a wider scope of malicious activity.
Threat actors are conducting phishing campaigns targeting Google Cloud Platform (GCP) environments by using sponsored search ads to steal privileged user credentials. They disable security controls, create service accounts with Gemini API access, and link attacker-controlled external projects to victim billing accounts. This enables unauthorized large-scale AI workload execution, causing significant unexpected charges within 24-48 hours. The attackers use evasion techniques such as geographic IP blending and demoting legitimate administrators to avoid detection and remediation.
In October 2026, hundreds of French supermarkets suffered a cyberattack that forced refrigeration systems into defrost mode, causing equipment damage and significant food loss. The attack targeted Danfoss StoreView dashboards, which manage refrigeration controllers. France had 1,331 exposed dashboards—more than the rest of the world combined—with 85% running software with known security flaws, including many end-of-life controllers. These systems had been exposed online for months prior to the attack. After the incident, most affected stores disconnected their dashboards rather than patching them. The exact attack vector remains unknown, and investigations are ongoing.
Between May and September 2026, a Russian-speaking threat actor targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker scanned millions of Ukrainian IP addresses to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 deserialization exploit delivered via Graylog's sessions API, the attacker gained access to at least two organizations, including a logging server containing millions of documents. The operation was exposed when the attacker accidentally served their working directory over HTTP, revealing tools and logs. Although the attacker queried transaction indices and showed knowledge of the system schema, no direct data exfiltration was observed. The campaign also involved failed exploitation attempts of other vulnerabilities.
A DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center version 3.5.8.7 is actively exploited by attackers distributing a genuine signed application with malicious DLLs via unofficial channels. The vulnerable software loads attacker-supplied DLLs without validation, enabling code execution. The attack uses ClickFix social engineering to trick users into running commands. Version 4.0.9.8 patches the vulnerability with automatic updates applied on restart. No official Siemens systems or distribution channels were compromised during this campaign.
Between April and July 2026, AOMEI Backupper, a Windows backup and disk cloning software, was compromised multiple times in short-lived supply chain attack windows. During these brief periods, users received a downloader for the ShinyRoad modular backdoor framework. The attacker, tracked as UNC7017, tampered with update server configurations to redirect users to malicious payloads, including the CrossRoad dropper, a modified Radmin Server with a malicious DLL, and the Adaptix C2 framework. The campaign used ephemeral tampering windows lasting only five to ten minutes, reverting quickly to authentic versions, which complicated detection. The attack affected a broad range of users opportunistically, with some higher education, IT services, and telecommunications organizations in multiple countries identified as compromised. AOMEI initially dismissed reports of tampering but later took corrective actions after repeated notifications.
The Russian espionage group Swallowtail targeted defense-related organizations in two NATO countries, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer. The attackers used malicious Word documents to deploy the Hookedge backdoor and conducted hands-on-keyboard operations. They stole credentials using SSH private keys for persistent tunnels and PowerShell scripts to capture NTLM handshakes. Additionally, they deployed a previously undocumented reflective loader (ld.exe) that decrypts payloads in memory with runtime-supplied keys. The campaign aligns with intelligence collection efforts against European government and defense sectors.
