Cybersecurity News: Research Digest

Date saved: 2026-10-28 03:00 (PDT)

Sources: CISA, Microsoft Security Blog, The Register, BleepingComputer, Security Boulevard, Brandefense, The Hacker News, SecurityWeek, Wired, Nick Shah, hexdigest, CERT@VDE, ShieldWorkz

Key findings

SafePay ransomware: CISA/FBI joint advisory

• CISA (October 20, 2026): The Cybersecurity and Infrastructure Security Agency, FBI, U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and the UK's North West Regional Organised Crime Unit issued a joint advisory on SafePay ransomware. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia, with at least 600 victims. Actors gain access by stealing or guessing passwords, exploiting vulnerabilities in internet-facing devices, and using phishing. Once inside, they use legitimate IT tools to move through networks and delete or disable backups before stealing data and encrypting systems. The advisory names five exploited CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. (Source)

• CISA (October 21, 2026): CISA confirmed SafePay ransomware has breached over 600 critical infrastructure organizations worldwide since 2024. The joint advisory was released October 20 with the FBI, USSS, and international partners. (Source)

PHP2Shell: CISA adds critical PHP flaws to KEV

• CISA (October 21, 2026): CISA urged immediate patching for PHP2Shell, two unauthenticated remote code execution flaws in PHP rated CVSS v4.0 9.2. The vulnerabilities affect all PHP installations serving web requests. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA added both flaws to its KEV catalog with an October 29 federal deadline. CISA said it had not observed exploitation as of its alert, but Perplexity logged 35 successful shell executions on honeypots. Unit 42 and Sophos walked back earlier claims about active exploitation. (Source)

• CERT@VDE (October 21, 2026): Critical vulnerabilities in PHP require immediate patching. The vulnerabilities, known as php2shell, allow for unauthenticated remote code execution in PHP. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. CISA strongly urges organizations to take action immediately. (Source)

LiteLLM supply chain compromise

• Microsoft Security Blog (October 23, 2026): On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to PyPI and distributed through official container images. The malicious package added files that Python could execute during normal interpreter initialization. An application did not need to import LiteLLM for the payload to run. The collector targeted authentication material across developer tools, AI applications, cloud environments, browsers, and infrastructure. Microsoft analyzed two execution paths: a credential collector launched through a path extension, and a Unix-oriented loader persisted through site-specific configuration. (Source)

• The Register (October 26, 2026): LiteLLM traced the supply chain attack to a master key it accidentally committed to a public GitHub repository in May 2026. The compromised version contained an infostealer and a remote access trojan. The trojanized package was available on PyPI for less than two hours but received about 49,000 downloads. The attack began May 27 when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. Developers removed the exposed commit but failed to revoke the master key. On October 10, the threat actor used the key to gain access and extract a GitHub CLI OAuth token, giving owner-level access to all repositories. (Source)

• BleepingComputer (October 2026): Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images. The supply-chain attack affected all PyPI wheels for version 1.107.0, impacting Windows, Linux, and macOS. The malicious packages were online for roughly three hours. The malware targeted cloud credentials (AWS, Azure, Google Cloud, Kubernetes, Docker), AI credentials (OpenAI, Anthropic, Cohere), developer secrets (Git, GitHub, npm, PyPI, CI/CD), browser data (Chrome, Firefox, Edge, Safari), and SSH/GPG/TLS keys. (Source)

ConnectWise and Storm-0940: agentic AI supply chain attack

• Microsoft Security Blog (October 21, 2026): Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state aligned actor active since 2021. The group used ARTEX, an open-source agentic AI penetration testing framework, to automate reconnaissance, password spraying, and OAuth application abuse since September 2026. The compromise targeted more than 2,250 tenants. This is the first publicly attributed large-scale supply-chain campaign driven by agentic AI. (Source)

• ShieldWorkz (October 17-23, 2026): The ConnectWise compromise is a watershed attribution. Microsoft tied the attack to Storm-0940, which weaponized the ARTEX framework to attack 2,250+ tenants at machine speed. The attack combined credential theft, OAuth abuse, and automated scanning into a single campaign. (Source))

Other major incidents and vulnerabilities

• hexdigest (October 26, 2026): A Japanese cloud host had malware pushed onto as many as 27,000 customer servers. A WordPress backup vendor's management keys were used to backdoor client sites. LiteLLM had release tokens stolen and shipped a credential-stealing 1.107.0 to PyPI and Docker Hub. A Miasma worm compromised 57 npm packages across 286+ malicious versions via Phantom Gyp, exploiting binding.gyp command substitution to execute obfuscated code during npm install. (Source)

• VicyTech (October 2026): The Pentagon confirmed a breach of its Defense Manpower Data Center affecting 2.76 million living and about 294,000 deceased people. Unencrypted PII, including Social Security numbers, was reachable through a file-sharing vulnerability from October 2025 to July 2026. CVE-2026-59310, a CVSS 9.8 unauthenticated directory-traversal RCE in vCenter's Syslog service, went from a China-nexus espionage tool to a ransomware delivery chain in under two months. Qilin and Settra ransomware operators are exploiting CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass patched in May 2026. (Source)

• ShieldWorkz (October 17-23, 2026): eMudhra certificate authority had eight intermediate CA private keys that were tiny integers, one literally the number 4, allowing anyone to forge trusted certificates. The keys were exposed for roughly 17 months. Atlas were compromised. A CVSS 10.0 GitLab vulnerability was patched. (Source))

• Nick Shah (Mid-August to Mid-October 2026): Microsoft released 1,400 patches in October, blasting past September's level of nearly 1,000. At least 78 flaws were rated critical. A ransomware attack forced the shutdown of Japan's IDC Frontier cloud provider, disrupting services for nearly 500 companies and government organizations. Ahold Delhaize confirmed a cybersecurity event disrupting operations across European supermarkets. Burger King Japan confirmed a data breach affecting more than 11 million customer records. (Source)

• The Hacker News (October 23, 2026): Hackers breached enterprise firewalls and VPNs, exposing over 70,000 credentials in a large-scale campaign targeting Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Qilin and INC ransomware groups are exploiting a now-patched Palo Alto Networks flaw (CVE-2026-0257, CVSS 7.8) to bypass MFA and set up unauthorized VPN connections. (Source)

• SecurityWeek (October 2026): The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, including human resources records, training materials, and internal documents. Oracle released an emergency Java security update for CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates, with a CVSS 3.1 score of 9.1. Splunk released updates for 24 vulnerabilities including four critical flaws with CVSS scores from 9.3 to 9.9. (Source)

Source links

• CISA: #StopRansomware SafePay Ransomware Advisory
• Microsoft Security: Inside the LiteLLM supply chain compromise
• The Register: LiteLLM supply chain attack started with exposed master key
• BleepingComputer: LiteLLM release pipeline hacked to distribute info-stealer
• Security Boulevard: Black October was an investigation problem before it was a patching problem
• CISA: CISA, FBI and Partners Warn of SafePay Ransomware
• Nick Shah: Cybersecurity News Roundup Mid-August to Mid-October
• hexdigest: 26th October Threat Intelligence Report
• YouTube: CISA Director on Ransomware and Critical Infrastructure
• YouTube: Supply Chain Attacks Explained - The LiteLLM Incident