Date saved: 2026-10-26 12:17 (PDT)
Sources: CISA, FBI, BleepingComputer, Nextgov, Forrester, Quantum, CSA Singapore, Expel, The Hacker News, Security Boulevard, Cyber.netsecops, Ars Technica, Register, SANS, InfoSecurity Magazine, Aviatrix, Bellingcat, CERT-FR
Key findings
PHP2Shell: critical PHP vulnerabilities under active exploitation
- CISA / Quantum / PHP Project (October 21, 2026): The PHP project disclosed two critical vulnerabilities in PHP core and released fixes. They are known publicly as PHP2Shell. CVE-2026-109618 is an out-of-memory error that can leave request memory uninitialized. CVE-2026-109619 is stale global state that can still point to freed request memory. Both can lead to unauthenticated remote code execution. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the PHP web worker process, and to disclose memory. One crafted HTTP request can trigger it, before any application code runs. CVSS scores: 9.8 (CRITICAL) for both. Proof-of-concept exploit code is publicly available, and security researchers have reported early exploitation attempts against internet-facing PHP servers. As of this bulletin, neither CVE is listed in the CISA Known Exploited Vulnerabilities catalog. (Source)
- Nextgov / NSA / FBI / CISA (October 21, 2026): The NSA, FBI, and Cybersecurity and Infrastructure Security Agency urged organizations to fix two critical flaws in software that powers much of the web, warning that systems should be taken offline if they cannot be secured promptly. The flaws affect PHP, a programming language that works behind the scenes to run websites, process forms, and retrieve information. Hackers could exploit the flaws to run commands on an affected server without logging in, potentially allowing them to steal data, change a website's contents, or take control of it. While CISA has not observed exploitation as of the time of publication, they pose a risk to organizations if left unpatched. Cybersecurity company Wiz demonstrated successful attacks against WordPress, Drupal, and Joomla installations. PHP's developers also said all installations handling web requests are at risk. (Source)
- Forrester (October 22, 2026): The two flaws were leaked online on October 20, forcing the PHP team to follow up with an announcement of an emergency patch. PHP2Shell vulnerabilities have not been registered in the CISA Known Exploited Vulnerabilities catalog, but CISA released an alert urging organizations to patch immediately. Other KEV sources and vendors report that they have seen exploitation and probing attempts. (Source)
- CSA Singapore (October 21, 2026): Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately. There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept exploits. These vulnerabilities affect all versions of PHP. (Source)
SafePay ransomware: 600 critical infrastructure organizations compromised
- CISA / FBI / USSS / UK NCA / Germany LKA Rheinland-Pfalz (October 20, 2026): SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. Since August 2024, SafePay ransomware group's operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors. The group gets initial access by exploiting unpatched VPN and edge-device vulnerabilities, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, it disables security and backup services, resets network storage devices, encrypts files, and threatens to publish stolen data. SafePay is believed to be behind the November 2024 ransomware attack on U.S. business services firm Conduent, which resulted in a substantial amount of personal and healthcare data being exfiltrated. On October 16, 2026, Conduent agreed to pay $80 million to settle a class action lawsuit related to the data breach. (Source)
- BleepingComputer (October 21, 2026): CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. Paying ransoms does not guarantee recovery of files encrypted in ransomware attacks, and victims are urged to report incidents to law enforcement. (Source)
- InfoSecurity Magazine (October 21, 2026): The SafePay ransomware group has compromised at least 600 critical infrastructure organizations, according to a joint advisory issued by government agencies from the U.S., Germany, and UK. SafePay is believed to be behind the November 2024 ransomware attack on U.S. business services firm Conduent. (Source)
Ivanti Connect Secure zero-day exploitation, Plex vulnerabilities, Microsoft Mark of the Web bypass
- CISA (October 13, 2026): CISA is aware of Ivanti's disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog on October 13, 2026. CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version. (Source)
- SANS NewsBites (October 16, 2026): CVE-2026-96951, CVSS score 8.8, allows an unauthorized attacker to bypass the Mark of the Web security feature over a network by exploiting a command injection vulnerability in Windows Shell. Microsoft lists the flaw as exploited, and it has been added to CISA's Known Exploited Vulnerabilities catalog with a three-day mitigation window. On October 14, Cisco published a security advisory addressing a critical path traversal vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway (CVE-2026-76519, CVSS score 9.8). CISA added it to the KEV catalog on October 14 with a mitigation deadline of October 17. (Source)
- CISA (October 20, 2026): CISA added six known exploited vulnerabilities to the catalog, including four Plex Media Server vulnerabilities and one EG Secure Solutions SiteGuard vulnerability. (Source)
Broader landscape: Pentagon DMDC breach, Warlock ransomware, French supermarket refrigeration hack, Denmark CPR breach
- Aviatrix / Pentagon (October 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange. International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. (Source)
- Security Boulevard (October 2026): The ransomware and extortion group n0n listed more than 40 port authorities, port operators, ship managers, and sea-shipping companies on its leak site on October 12. The likely way in was maritime IT services provider CyberLogitec. Half of the listed victims are known CyberLogitec customers. (Source)
- Cyber.netsecops (October 13, 2026): A cyberattack on refrigeration systems, linked to Danish provider Danfoss, caused significant food spoilage across hundreds of supermarkets in France, Belgium, and the Netherlands. Attackers manipulated the appliances' defrost mechanisms, causing them to reach temperatures of up to 50 degrees Celsius. The attack targeted devices from multiple vendors: Danfoss AK-SC and AK-SM series, and Copeland XWEB devices. The supermarket refrigeration controller cyberattack targeted devices from multiple vendors. (Source)
- The Hacker News (October 23, 2026): Hackers breached enterprise firewalls and VPNs, exposing over 70,000 credentials. Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. (Source)
- BleepingComputer (October 2026): Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan. An international law enforcement operation dubbed Operation KillSwitch seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. (Source)
The headline this week is PHP2Shell: two critical vulnerabilities in PHP, the programming language that powers an estimated 70 percent of websites, disclosed on October 21 with CVSS scores of 9.8 and 9.2. Both can lead to unauthenticated remote code execution. Proof-of-concept exploit code is publicly available, and security researchers have reported early exploitation attempts against internet-facing PHP servers. The NSA, FBI, and CISA all urged organizations to fix the flaws immediately, warning that systems should be taken offline if they cannot be secured promptly.
At the same time, CISA and the FBI jointly declared that the SafePay ransomware group has compromised at least 600 critical infrastructure organizations worldwide since August 2024, making it one of the most active ransomware groups in 2026. The group gets in through unpatched VPN and edge-device vulnerabilities, some of them years old, and uses double-extortion tactics. The advisory was joint with the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency.
The throughline: critical infrastructure is running on unpatched edge devices, flat networks without segmentation, and VPNs without multi-factor authentication, and the groups exploiting those gaps are scaling fast. SafePay's 600 victims are only the ones who did not pay and ended up on the leak site; the actual number is higher. The PHP2Shell vulnerabilities affect all versions of PHP and can be triggered by a single crafted HTTP request before any application code runs. These are not vendor blog roundups; these are government-grade emergencies.
Source links
- CISA: #StopRansomware: SafePay Ransomware Advisory AA26-293A
- Nextgov: US agencies urge fixes for programming language flaws putting millions of web systems at risk
- Forrester: PHP2Shell Leak Sends Security Teams Scrambling
- BleepingComputer: CISA: SafePay ransomware hit over 600 critical infrastructure orgs
- CISA: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
- Quantum: PHP2Shell Vulnerabilities Security Bulletins
- SANS NewsBites: NewsBites Volume XXVIII - Issue 77
- Aviatrix: Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist
- YouTube: CISA - SafePay Ransomware Advisory Briefing
- YouTube: BleepingComputer - PHP2Shell Critical PHP Vulnerabilities Explained