DFIRLab
All Briefings
weeklyOctober 19, 2026 — October 26, 2026Published 07:04 UTC

Weekly Threat Briefing — 2026-10-19 to 2026-10-26

72 findings154 articles6 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
154 Articles1,902 CVEs44,456 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 49
Browse all 72 findings

Executive summary · as of 07:04 UTC

The situation

The week was dominated by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical PHP core remote code execution flaws whose details leaked before disclosure. Amazon Threat Intelligence reports exploitation began four days before the emergency patches shipped. Roughly 70% of websites need core updates, and many operators took sites offline to patch. Several public PoCs are non-functional, so a failed test does not prove a server is patched. A separate, still-unpatched PHP RCE affecting non-default configurations has mitigations only.

Browse the full briefing

72 findings · 6 sections
Findings by severity
  • 12 critical
  • 37 high
  • 17 medium
  • 6 low
Vulnerabilities9 critical · 10 high · 1 medium

Vulnerabilities & Exploitation

PHP2Shell is the priority: exploited pre-patch, near-universal exposure, and unreliable PoCs. Key exploited and critical items: - CISA KEV gained eight entries: the Plex2Shell chain, Arista VCO, Collabora, SiteGuard and Siemens. - PAN-OS CVE-2026-0257 remains under ransomware exploitation. - HPE ArubaOS, GitLab, Oracle, Next.js and Pillow released critical patches. Volume this week: 1,886 NVD, 271 OSV and 160 WordPress entries; only the highest-impact are shown.

Malware1 critical · 13 high · 2 medium

Malware & Supply Chain Compromise

Supply chain compromises hit LiteLLM, AOMEI, Onamae Desktop Cloud and OVHcloud. ClickFix and GitHub-hosted lures dominated abuse.ch's 44,448 new indicators across 450 families, alongside the BlackX UEFI bootkit and Lazarus PQC-protected delivery.

  • Critical severity
    LiteLLM 1.107.0 supply chain compromise delivers credential stealer via Python startup hooks (opens the source in a new tab)

    Attackers compromised LiteLLM's release pipeline, publishing a malicious 1.107.0 PyPI package and Docker images. The payload uses Python startup hooks to execute on interpreter launch. It steals credentials, secrets and environment variables, and loads remote code. Recommended actions: - Identify hosts and containers with 1.107.0. - Rotate all secrets reachable from them, especially LLM API keys and cloud credentials. - Review site-packages for unexpected .pth files.

    Source: RSS
  • High severity
    AOMEI Backupper update servers hijacked to push remote access malware (opens the source in a new tab)

    Attackers repeatedly altered configuration files on AOMEI Backupper update servers between April and July. For minutes at a time, the software was redirected to download malware that gives remote access. AOMEI has not yet notified customers. Hunt for anomalous child processes and outbound connections from AOMEI updaters during that period.

    Source: RSS
  • High severity
    Onamae Desktop Cloud provider breach: malware on up to 27,000 customer servers (opens the source in a new tab)

    Attackers compromised provider infrastructure at Japanese VPS service Onamae Desktop Cloud and installed malware on up to 26,739 customer servers. Customers should treat affected VPS instances as compromised and rebuild them.

    Source: RSS
  • High severity
    BlackX UEFI bootkit abuses Baton Drop to bypass Secure Boot (opens the source in a new tab)

    BlackX is a UEFI bootkit used in an early-2026 espionage campaign. It exploits the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver that interferes with Kaspersky and Avast. Ensure DBX revocation updates are applied.

    Source: RSS
  • High severity
    Lazarus adopts post-quantum cryptography for payload delivery (opens the source in a new tab)

    North Korean Lazarus operators are using a post-quantum cryptographic mechanism to secure payload delivery. The new operations combine old and new malware families, which complicates network inspection of staged payloads.

    Source: RSS
  • High severity
    ClickFix campaign abuses Windows 'finger' utility to deliver Lumma Stealer (opens the source in a new tab)

    Malicious Amazon-related Google search results lead to a ClickFix CAPTCHA that abuses the legacy Windows finger.exe utility to fetch and install malware, including Lumma Stealer. Separately, Push Security reports ClickFix volume at record levels, with fake AI installers as lures. Recommended actions: - Alert on finger.exe outbound connections. - Alert on clipboard-pasted Run-dialog commands.

    Source: RSS
  • High severity
    AI coding agent hijacked via malicious AGENTS.md to install rogue npm package (opens the source in a new tab)

    Researchers found a malicious AGENTS.md instruction file in a user's Downloads folder. It caused an AI coding agent to install a rogue npm package, showing that agent instruction files are an injection vector. Restrict agent working directories and require approval for package installs.

    Source: RSS
  • High severity
    OVHcloud GitHub compromise linked to GlassWorm actors (opens the source in a new tab)

    A developer's GitHub account was compromised months earlier and later used to push malicious code to OVHcloud users. The activity is tied to the GlassWorm threat actors.

    Source: RSS
  • High severity
    SmartLoader GitHub-hosted ZIP lures (12,281 URLs)

    Indicators: 11,365 URLhaus malware_download URLs (github/SmartLoader/zip), plus 916 under the FakeGit tag. They serve ZIP archives from throwaway GitHub repositories posing as software projects. Samples: - hxxps://raw[.]githubusercontent[.]com/yutthanaiam/nongmod/refs/heads/master/vendor/composer/Software-2[.]6[.]zip - hxxps://raw[.]githubusercontent[.]com/trieuduy27051999/Quiz-Games/refs/heads/main/ios/RunnerTests/Quiz_Games_1[.]1[.]zip - hxxps://github[.]com/Manipulationjuniperbush648/NetSwift/raw/refs/heads/main/autoalkylation/Swift-Net-1[.]0[.]zip

    Source: abuse.ch
  • High severity
    zapret-themed GitHub lures distributing SalatStealer

    Fake 'zapret' Discord/YouTube/Telegram unblocking tools on GitHub releases account for more than 12,600 malware_download URLs: - 6,622 tagged github/zapret. - 4,642 tagged with SalatStealer. - 924 SalatStealer EXEs. - 454 additional zapret ZIPs. ThreatFox separately tracked 313 SalatStealer payload and C2 indicators. Samples: - hxxps://github[.]com/WishSwordsman/discord-fix/releases/download/ZapretDiscord/zapret-discord-youtube-1[.]9[.]9d[.]zip - hxxps://github[.]com/gripinvestorwrench/telegram-zapret-exe/releases/download/11[.]9[.]5/zapret-telegram-fix[.]exe

    Source: abuse.ch
  • High severity
    VShell C2 infrastructure (2,147 indicators)

    ThreatFox logged 2,147 VShell indicators (payload hashes and botnet_cc ip:port), making VShell the largest C2 family this week. Sample C2s: - 101[.]201[.]75[.]136:8084 - 43[.]142[.]129[.]189:8086 - 177[.]3[.]92[.]247:8084

    Source: abuse.ch
  • High severity
    AMOS macOS stealer (1,735 indicators)

    ThreatFox logged 1,735 Atomic macOS Stealer (AMOS) indicators covering payload, payload_delivery and botnet_cc, as hashes, URLs, domains and ip:port. Sample hashes: - f50843c01ba9df306195220951c450a19d7e45ea4d8de1e6e236378f993dbc39 - 151c4c3cb12fb3cac7f5c5871eb44fefde1fad10b84b73a8e4c871842128ac45

    Source: abuse.ch
  • High severity
    IClickFix and ClearFake delivery infrastructure (2,574 indicators)

    ThreatFox tracked fake-CAPTCHA and fake-update delivery infrastructure (payload_delivery and botnet_cc domains and URLs): - IClickFix: 1,653 indicators. - ClearFake: 921 indicators. Samples: - checkgwfwtg465[.]art - cloud-browse[.]codes - cinecluster[.]com

    Source: abuse.ch
  • High severity
    Vidar and other infostealer infrastructure

    ThreatFox logged 1,641 Vidar indicators (C2 URLs, domains and payload hashes). StrelaStealer (530 delivery domains), Raven Stealer (104 hashes) and PureRAT (117 C2s) were also active. Sample Vidar C2s: - hxxps://bh[.]9winter[.]com/h4/ - hxxps://bh[.]9winter[.]com/hwm/

    Source: abuse.ch
  • Medium severity
    Mirai and Mozi IoT botnets (2,600+ indicators)

    IoT botnet activity remained steady: - Mirai: 1,458 indicators. - Mozi: 628 indicators, plus 402 MIPS and 156 ARM ELF download URLs. Samples: - hxxp://42[.]233[.]211[.]139:32917/i - hxxp://182[.]127[.]178[.]64:45042/i

    Source: abuse.ch
  • Medium severity
    Cobalt Strike, Sliver and PHP web shell infrastructure

    ThreatFox logged new post-exploitation framework C2s: - Cobalt Strike: 349 indicators. - Sliver: 154. Separately, 231 php.shin_webshell indicators were added, relevant to PHP2Shell post-exploitation hunting. Samples: - 103[.]236[.]84[.]103:6443 (Cobalt Strike) - 139[.]180[.]185[.]170:22809 (Sliver) - kisudi[.]workers[.]dev (php.shin_webshell)

    Source: abuse.ch
Threat Actors1 critical · 5 high · 5 medium

Threat Actors & Campaigns

Storm-0940's AI-accelerated ConnectWise attack is the standout nation-state event. Russian actors (Sandworm, APT28) remain active against Ukraine and NATO targets, and SafePay drew a joint advisory. Law enforcement scored a large win with Operation Serengeti III.

Data Breaches & Leaks1 critical · 8 high · 3 medium

Data Breaches & Leaks

226 breach and leak entries were recorded (40 reviewed). Credential-exposing events lead: Railway secrets, Capcom account tampering, and J.B. Hunt forced password resets. Large-scale exposures at Capcom, ETS and Quest follow, alongside heavy leak-site activity from Qilin, Whitearmor, Falcon, emperador, N0n and krybit. No pwnCount or dataClass fields were supplied for leak-site entries.

Tools & Techniques1 high · 2 medium · 2 low

Tools, Techniques & Detection

This week's detection and forensics resources cover PHP2Shell exploitation, WMI persistence and OAuth abuse. Defensive platforms are also adding ClickFix and phishing controls.

Policy4 medium · 4 low

Policy & Regulation

Privacy enforcement (Meta, 23andMe, Frontier, ICO) and China-related technology restrictions (DeepSeek, HiSilicon) led the week. There are also regulatory gaps for OT patching and an upcoming Windows Server 2016 end of life.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.