Daily brief
Wednesday, 28 October 2026
PHP2Shell is now on CISA's KEV list, Moldova pulls 80+ public services offline after an attack, and Interpol's Serengeti sweep tops 1,400 arrests.
Top stories
- PHP2Shell flaws added to CISA KEV
#vulnCRITICALEXPLOITEDKEV— CISA added CVE-2026-109618 and CVE-2026-109619, the two unauthenticated RCE bugs in the PHP engine itself, with a three-day federal deadline. Why it matters: PHP sits behind most of the web (WordPress, Drupal, Magento, cPanel…), and many hosts run end-of-life branches that get no official fix. Unit 42 threat brief · Recorded Future - Moldova takes down 80+ public services after cyberattack
#breach— The government pulled more than 80 online public services offline following an attack. Why it matters: another reminder that small states’ centralised e-government platforms are high-value targets. Risky Bulletin - Interpol’s third Operation Serengeti: 1,462 arrests
#industry— The sweep across 20 African countries and the US recovered $105 million in stolen funds. Why it matters: cross-border policing of scam and fraud operations is maturing. Dark Reading
Vulnerabilities & patches
- CVE-2026-48356 — Adobe Commerce / Magento
CRITICALEXPLOITEDKEV— Unrestricted file upload of dangerous file types, added to KEV on 27 Oct (federal due date 10 Nov). Patch any Magento store now. CISA alert - CVE-2026-111497 — Google Brotli
EXPLOITEDKEV— Unchecked return value in the Brotli compression library, added to KEV the same day. Brotli is embedded in browsers, web servers and countless libraries, so check your dependency tree. CISA alert - ICS advisories: EPICS Base and Mitsubishi Electric ICONICS
HIGH— EPICS Base bugs allow DoS, memory corruption and possible code execution; the ICONICS / GENESIS suite has authentication bypasses (CVE-2026-16436, CVE-2026-16437). CISA — EPICS · CISA — Mitsubishi
Threat intel & red team
- ‘Aokigahara’ stealer goes after developer keyrings and AI assistants
#threat— A new infostealer targets AI tool sessions and developer credentials alongside the usual browser data, exposing business data and infrastructure from one endpoint. Dark Reading - Mail bombing + external Teams chats deliver malware in 15 minutes
#threat#ransomware— A wide-scale social-engineering campaign, possibly tied to Black Basta, floods inboxes then contacts victims as “IT support” via external Teams chats. Dark Reading
Blue team & defense
- Lock down external Teams access
#defense— The campaign above relies on external tenants being able to message your users; restricting external access to allow-listed domains removes the channel. Dark Reading
Industry, policy & developments
- UK MP takes xAI to court over Grok deepfakes
#industry#ai— Jess Asato, who campaigns for victims of online abuse, became a victim of Grok-generated deepfakes herself. Wired
Worth reading
- SBOMs alone can’t reveal the scope of a supply chain attack
#learning— Why a bill of materials tells you what you ship, but not what an attacker actually touched. Dark Reading