Touchpoint Weekly Threat Roundup

PHP2Shell, Exploited Edge Flaws and a Wave of AI-Infrastructure Compromises: The Week in Cyber

TSTouchpoint Security·October 25, 2026·Covers Oct 19 – 25, 2026

A leak forced PHP to ship emergency fixes for two critical code execution flaws, and attackers were probing them before patches existed. Exploited Arista VeloCloud and Collabora flaws joined CISA's catalog, a Brotli decoder bug reached Node.js, Python and Envoy, and compromised CA keys sent browsers into emergency updates. Supply-chain attacks on AI infrastructure and Microsoft 365 tenants, and breaches at Quest Diagnostics and Capcom, kept the affected people, and the obligations that follow, in view.

Top story of the week PHP's emergency PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) arrived after attackers had already started probing, so every PHP runtime should be upgraded now.

The week at a glance

Click any row to jump to that story.

Date Category Item
Oct 23 Vulnerability Exploited Arista VCO and Collabora CODE Server flaws added to KEV
Oct 23 Vulnerability PHP discloses unpatched CVE-2026-115560 with a mitigation
Oct 22–23 Breach Quest Diagnostics reports access to patient records
Oct 22 Breach Capcom confirms 11.77 million CAPCOM ID accounts accessed
Oct 22 Law enforcement INTERPOL Serengeti III: 1,462 arrests, USD 105M+ recovered
Oct 21 Vulnerability PHP2Shell emergency fixes (CVE-2026-109618, -109619)
Oct 21 Vulnerability Node.js and Brotli patch Node2Shell (CVE-2026-111497)
Oct 21 Vulnerability GitLab fixes CVSS 10.0 RCE (CVE-2026-110264)
Oct 21 Breach LiteLLM release pipeline hijacked; Railway secrets exposed
Oct 21 Threat actor Microsoft ties ConnectWise-app attacks to Storm-0940
Oct 21 Compliance New Mexico court orders $25 billion Meta penalty
Oct 20 Vulnerability Browsers distrust compromised eMudhra CA keys
Oct 20 Vulnerability Exploited Plex and Siemens Software Center flaws added to KEV
Oct 19 Lookalike domains Okta and ServiceNow combosquatting in vishing campaign
Oct 19 Compliance California and Massachusetts settle data-protection claims

Vulnerabilities and patches

PHP2Shell: emergency PHP fixes, pre-patch probing and a second open issue

On October 21, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 (memory corruption in out-of-memory handling) and CVE-2026-109619 (a use-after-free from stale state in persistent workers). PHP scores both CVSS 4.0 9.2; the 10.0 that circulated with the October 20 leak was wrong. Every PHP install serving web requests is affected, and the PHP Foundation demonstrated code execution against default Apache mod_php.

Amazon's honeypots logged a first attempt on October 17, four days before disclosure, and attempts surged once proof-of-concept code appeared. Sophos saw a Mirai-derived botnet payload but withdrew an early report of a successful compromise; as of October 23 the Canadian Cyber Centre reported no confirmed exploitation, and the CVEs are not in CISA's KEV catalog. On October 23 PHP disclosed CVE-2026-115560, an unpatched session upload-progress issue affecting only applications that change the session serialize handler at runtime.

What to do. — click a step to check it off, click any code snippet to copy it

  1. Patch and verify. Upgrade every PHP runtime, including container images and appliances; PHP 8.1 and older get no official release, so migrate or use distribution or LTS-vendor backports. Restart PHP-FPM or Apache so workers load the new build, then confirm the running version on each host and rescan.
  2. Mitigate where you cannot patch yet. Apply PHP's interim settings, including session.upload_progress.enabled=0 in php.ini or the FPM pool (this also covers CVE-2026-115560).
  3. Check for compromise since October 17. Look for new or modified .php files in upload, cache and temp directories and web roots, and file modification times since probing began. Review logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS and php2shell-scan user agents. Look for shells, wget or curl spawned by PHP or the web server, files such as /tmp/nfs, and new accounts, cron jobs or SSH keys.
  4. Harden. Make upload and cache directories non-executable at the web server level, run PHP as a low-privilege user and restrict outbound traffic from web servers.
  5. If you find a webshell or suspicious process: isolate the host, preserve logs, rebuild from a known-good source, and rotate database passwords, API keys and other secrets the application could read.

Exploited Arista VeloCloud Orchestrator and Collabora flaws added to KEV

Arista's CVE-2026-114625 (CVSS 3.1 9.9) is an actively exploited SQL injection in on-premises VeloCloud Orchestrator that lets a low-privileged user gain operator rights. Fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12. CISA added it on October 23 with CVE-2026-110447 (CVSS 4.0 9.2), an unauthenticated command injection in Nextcloud's built-in Collabora CODE Server app, fixed in 26.4.303; the federal deadline for both is October 26.

What to do. Patch now and confirm the fixed versions are running. Because both were exploited before fixes, check for compromise: review VCO operator accounts, recent configuration changes and logs for Arista's listed IPs 74.82.197[.]86 and 38.54.50[.]151. On Nextcloud servers, look for unexpected PHP files in the web root and the app directory. Disabling the Collabora app does not help. Restrict both management interfaces to trusted networks. If you find signs of access, rebuild and rotate the credentials those systems hold.

Node2Shell: a Brotli decoder flaw reaches Node.js, Python and Envoy

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, triggered by malformed compressed data. Node.js fixed its bundled copy on October 21 in 22.23.4, 24.22.1 and 26.12.1 (rated High); end-of-life lines stay unpatched. Imperva showed code execution on an official Node.js 24.22.0 Linux arm64 build via fetch() responses and Express 5 or body-parser 2 configured to decode Brotli bodies. Brotli (1.0.10, 1.1.1, 1.2.1), Python Brotli (1.2.1) and Envoy, which scores it CVSS 4.0 9.2, have also shipped fixes. There is no known exploitation or KEV listing.

What to do. Find Node.js runtimes, including copies in containers, serverless images and Electron-based apps, and upgrade them along with Brotli libraries and proxies. Then confirm with node -v in each built image, not just on the host. Avoid decoding untrusted Brotli input where practical. As a check, review logs since October 21 for node crashes and unexpected child processes of node.

Breaches and ransomware

Quest Diagnostics: unauthorized access to patient records

Quest learned on October 21 that an unauthorized party had accessed Quanum LSM, the system clinicians use to order tests and retrieve results. Its SEC Form 8-K (Item 8.01) and public notice say certain patient records were accessed, operations were not materially disrupted, and the incident is unrelated to PHP2Shell. Quest has not yet said how many people are affected or which data fields were involved. Lab orders and results can reveal diagnoses and medications, among the most sensitive information a person has. Quest says affected patients will receive letters offering credit and identity monitoring; as a HIPAA covered entity, it is likely to engage the HIPAA Breach Notification Rule and state notification laws.

What to do. Clinics using Quanum should follow Quest's guidance and review their accounts. Patients should enroll in the monitoring offered, check explanation-of-benefits statements for services they did not receive, and be wary of calls or emails claiming to be from Quest.

Capcom: 11.77 million CAPCOM ID accounts accessed

Capcom disclosed on October 22 that unauthorized access found on October 19 exposed email addresses and account metadata, including last-login IP address, for 11,774,247 accounts; 43 also lost date of birth, gender, region and nickname. Capcom has not confirmed any password leak, though attackers changed passwords on 196 accounts. No payment card data was involved. Capcom reported to police and Japan's Personal Information Protection Commission on October 21.

What to do. Affected users should expect Capcom-themed phishing using their real address and change any password reused from their CAPCOM ID.

LiteLLM and Railway: attacks on AI infrastructure supply chains

On October 21 an attacker used stolen GitHub tokens to publish a malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR for about two hours. LiteLLM traced the attack to a platform master key committed to a public repository in May and never revoked. The malware stole cloud, SSH and Git credentials, browser data, AI coding-tool tokens and stored provider keys. The same day, Railway said an unauthorized party may have read decrypted customer environment variables, which it believes is part of a wave of attacks on AI inference providers' keys.

What to do. If you installed 1.107.0 or pulled the affected tags, pin to 1.106.2. Search hosts for the cook.pth, cook.py and sitecustomize.py files LiteLLM lists, and rebuild rather than clean them. Rotate every credential the host could reach, then review cloud and AI-provider logs since October 21 for use of the old keys. Railway customers should rotate all environment variables and registry credentials, revoking leaked keys at the provider.

Threat actors and campaigns

Storm-0940 used AI agents and ConnectWise app credentials against Microsoft 365 tenants

On October 21 Microsoft attributed the attacks that forced ConnectWise to suspend Cloud Backup to Storm-0940, which it assesses as aligned with the Chinese state. Using ARTEX, an open-source multi-agent AI penetration-testing framework, the group sometimes moved from targeting to privileged access in under three hours. After password spraying — Microsoft recorded more than 151,000 failed logons between October 10 and 14 — it used stolen credentials for ConnectWise's multi-tenant apps to attempt sign-ins to more than 2,250 tenants. Inside, it added app credentials, granted roles (one app made itself Global Administrator) and bulk-read Azure Key Vault secrets. Targets spanned defense, government, finance, energy and technology; most attempts failed.

What to do. Keep the ConnectWise apps disabled, not deleted, until ConnectWise gives restoration steps, and search by application ID. Review logs from October 1 for new app credentials, role or consent grants and Key Vault bulk reads, rotate exposed secrets, and trim third-party app permissions.

Lookalike domains and brand impersonation

Okta and ServiceNow combosquatting domains in a vishing campaign

Dataminr reported on October 19 a campaign pairing target companies' names with Okta (okta.com) or ServiceNow (servicenow.com). Published domains include riskified-okta[.]com, shipmonk-servicenow[.]com and gladly-okta[.]com (found October 18–19), plus earlier yotpo-okta[.]com, paddleokta[.]com, attentive-okta[.]com, oktadialpad[.]com and servicenow-ticket[.]com. Fake single sign-on pages are paired with phone calls and an "MFA downgrade" lure pushing hardware-key users to SMS or email codes. Targets are e-commerce, logistics, marketing and payments SaaS firms; no takedowns are reported.

What to do. — click a step to check it off

  • Block the published domains in DNS filtering, web gateways and email security, and hunt for past visits.
  • Monitor new domain registrations and Certificate Transparency logs for your brand plus "okta," "sso" or "servicenow"; consider defensive registrations and enforce DMARC at p=reject.
  • Remove SMS and email fallback for phishing-resistant MFA users, and alert on new MFA enrollments right after sign-in.
  • Tell staff to check the real domain and never sign in via a link sent during a call; password managers and passkeys will not fill in on a lookalike.

Compliance, regulation and personal data

New Mexico: $25 billion civil penalty against Meta (October 21) The New Mexico Department of Justice said the court ordered Facebook's parent to pay $25 billion after a jury found 43,899,725 violations of the state's Unfair Practices Act. The Record reports the case stems from the Cambridge Analytica data-sharing matter and that Meta plans to appeal.
State attorneys general settle data-protection claims (October 19) California reached a $6 million settlement, pending bankruptcy-court approval, with Chrome Holding Co., formerly 23andMe, over the 2023 breach of personal and genetic data affecting about 7 million customers, including more than 855,000 Californians; consumers keep the right to delete data and have samples destroyed. Massachusetts reached a $1 million settlement with Transformative Healthcare over alleged billing practices and an alleged lack of an adequate written security program before a 2023 breach that potentially affected 750,116 residents.
UK ICO reprimand On October 20 the ICO reprimanded Ogi Networks and Data Cymru after a 2024 ransomware attack that began through a 12-year-old test account with the password "Password1"; about 3,300 people, most of them children, were affected.
What the week's incidents mean for similar organizations Quest's discovery starts HIPAA's clock: individual notice without unreasonable delay and within 60 days, plus HHS and, above 500 residents of a state, media notice. Global consumer platforms with EU or UK users should expect GDPR's 72-hour regulator notification to apply. The ConnectWise, LiteLLM and Railway incidents may still trigger customer notification duties if downstream personal data was accessed, so document assessments and rotations now; NIS2 and DORA entities should log them as third-party incidents.

This section is general information, not legal advice.

Also notable this week

INTERPOL's Operation Serengeti III An operation across 20 African countries and the United States, run June 29 to August 31, led to 1,462 arrests, recovered more than USD 105 million and disrupted 10,909 malicious networks tied to 65,929 victims, INTERPOL announced October 22. Keep verifying payment changes by a known phone number; takedowns rarely end a fraud model.
Compromised eMudhra CA keys (October 17–22) A researcher proved control of private keys for eight eMudhra intermediate certificates, caused by weak keys from an April 2025 key ceremony. eMudhra revoked them on October 18. Mozilla and Google blocked them within hours and are removing the emSign ECC Root CA – G3 (Chrome by October 27). Node.js updated its CA store, Go 1.27.3 and 1.26.10 block a small set of intermediate certificates, and eMudhra is exiting the global TLS business. Apply trust-store updates and rebuild Go apps, then confirm nothing you rely on still chains to eMudhra or emSign, and replace anything that does.
GitLab CVSS 10.0 flaw (October 21) GitLab fixed CVE-2026-110264, an integer overflow in the Onigmo regex compiler affecting releases back to 7.0, in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Ruby followed on October 23 with 4.0.9, 3.4.12 and 3.3.13 for the underlying bugs. Self-managed GitLab instances should upgrade now, then check for the "Onigmo native worker crash" and "Org mode render error burst" patterns GitLab published. Ruby applications that compile attacker-supplied regular expressions should update too.
More exploited flaws in KEV (October 20) CISA added four Plex Media Server flaws, a Siemens Software Center flaw and an EG Secure Solutions SiteGuard flaw. SecurityWeek reports the Siemens bug is being used in ClickFix malware attacks. Find and patch Plex servers on corporate or home-office networks, then check those hosts for unfamiliar processes.
Microsoft 365 token-replay campaign (October 22) Huntress described a campaign that replayed stolen post-MFA session tokens, captured via adversary-in-the-middle and device-code phishing, at 79 organizations between July and September. It attempted payroll fraud through hidden inbox rules. Phishing-resistant MFA and token-protection policies blunt this technique.
Typosquatted download sites for Chocolatey and Massgrave (October 22) Zscaler reported SEO-poisoned lookalikes choclatey[.]org and massgravel[.]net, impersonating chocolatey.org and massgrave.dev. They served a PowerShell command that installed the new Armorsteal info-stealer while running the real installer. Both sites were down by early October. Block them and hunt for the SysCheck2 and SysCheckX scheduled tasks.
Russian espionage and sabotage reports Symantec (October 20) tied APT28 to a new Hookedge backdoor used against a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO countries. ESET (October 22) detailed a 2025 UAC-0099 and Sandworm operation against a Ukrainian grain logistics firm, using a backdoor hidden in the Yggdrasil mesh network before a data wipe.
Edge-device credentials exposed (October 21) Group-IB reported an actor that breached FortiWeb, FortiGate and Palo Alto GlobalProtect devices through known flaws and exposed more than 70,000 credentials. Victims overlap with Qilin and The Gentlemen ransomware. Patch edge devices, check them for rogue admin accounts, and rotate any credentials stored on them.
Attackers operating AI agents (October 20–21) SOCRadar found exposed infrastructure showing INC and The Gentlemen ransomware affiliates using AI coding agents against 62 organizations. Symantec described a "Skynet" agent that hijacks exposed AI endpoints to run attacks and mine cryptocurrency at the owner's expense. Never expose model endpoints or MCP servers without authentication.
BlackX UEFI bootkit (October 22) Kaspersky reported a bootkit, attributed with medium confidence to APT41, that abuses the old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot on patched Windows systems where Microsoft's manual revocations were never applied. It targeted Central Asian diplomatic bodies. Apply the Secure Boot revocation steps.
Other incidents PingCAP (October 19) said an intruder with stolen service-account credentials copied TiDB Cloud user names, emails, billing details and source code between September 9 and October 7. State Bank of India (October 21) confirmed 3,897 customer records with names, mobile numbers, dates of birth and addresses on the dark web. Toronto Crime Stoppers (October 21) paused tip intake after a vendor breach exposed historical tips; this puts tipsters' safety at risk. Ahold Delhaize (October 19) confirmed malicious actors caused its outages and reported no evidence of data theft so far. People in these incidents should watch for targeted phishing and scam calls.
UK subsea cable proposals (October 22) The UK government proposed up to 14 years in prison and unlimited fines for intentional damage to undersea cables, plus new security duties for operators. The consultation closes January 14, 2027.
ShinyHunters investigation (October 19) KrebsOnSecurity reported the FBI charged a ransomware negotiation executive with extortion offences linked to the ShinyHunters extortion site. Vet incident-response and negotiation partners carefully.

Touchpoint's Take

The gap between disclosure and attack has all but closed. PHP2Shell was probed before patches existed, Arista's flaw was exploited as a zero-day, and an AI framework took Storm-0940 to privileged access in hours. Patching is now only the first step. Teams need an inventory that includes bundled runtimes, and the habit of checking for compromise before they close the ticket.

Trust is also inherited from suppliers: a vendor's multi-tenant app, a CA's keys, an open-source release pipeline. Each incident began with a credential that was too powerful or never revoked. Meanwhile, patients, gamers, children and anonymous tipsters bore this week's exposures. Regulators and courts are pricing that harm, so a record of what you knew and when now matters as much as the controls.

What to watch next week

  • October 26: CISA's remediation deadline for the exploited Arista VCO and Collabora CODE Server flaws. Palo Alto's PAN-OS hotfixes for PHP2Shell are scheduled for October 26–30.
  • October 27: Chrome's removal of the emSign ECC Root CA – G3 reaches all devices.
  • PHP: a fix for CVE-2026-115560 is promised with the next regular release, and a KEV listing for PHP2Shell remains possible.
  • November 3 and 10: KEV deadlines for the October 20 Plex and Siemens additions fall on November 3, and November's Patch Tuesday is November 10.

How Touchpoint Security can help

This week's stories share a common need: knowing what you run and acting on it fast.

  • PHP2Shell, Arista VCO and Node2Shell: Trace exposure management can identify affected internet-facing assets, while Pulse MDR provides 24/7 monitoring for exploitation attempts.
  • ConnectWise apps and LiteLLM: third-party risk reviews, plus cloud security assessments on Azure, AWS and GCP, help tighten vendor app permissions and secrets.
  • Okta lookalike domains and vishing: Decoy phishing simulations, training and investigation prepare staff to spot fake sign-in pages.
  • Quest and Capcom-style breaches: Attest compliance and GRC, our incident response retainer and tabletop exercises help you prepare for notification deadlines.

To talk through any of these, contact Touchpoint Security.

Sources

PHP2Shell
Arista, Collabora and KEV
Node2Shell / Brotli
eMudhra
Breaches
Threat actors and lookalike domains
Law enforcement and compliance
Also notable

Not sure where you stand on any of this?

Our team is available to talk through your exposure to this week's issues.

Contact us