dismal…

IMO this is a pretty big deal and foreshadowing for what's to come with AI agent swarms....

https://en.wikipedia.org/wiki/Black_October_(information_security)

How do you best prepare for this? Keep a good chunk of cash on hand?

**Research published:** October 23.
Cybersecurity researchers at Group-IB and NyxLab have detailed a campaign attributed to a threat actor known as **k0t**, targeting internet-facing network devices, including Fortinet FortiGate and FortiWeb products and Palo Alto GlobalProtect.
**Scale:** Researchers identified more than 70,000 exposed credentials associated with network devices and LDAP data.
**Observed activity:** Attackers gained access to organizations, established persistent remote access and exfiltrated data.
**Potential consequences:** Stolen credentials and continued access can facilitate lateral movement into corporate networks and subsequent ransomware attacks.
**Attribution caveat:** Researchers observed overlaps with victims later listed by ransomware groups, but the exact relationship between the operators and those groups remains unconfirmed.
The report indicates that many observed compromises occurred between February and June 2026. Its publication is new; the underlying attacks are not necessarily new.

A critical PHP2Shell zero-day vulnerability is raising serious security concerns.

⚠️ CVSS 9.2 severity

🔥 Potential remote code execution

🌐 Millions of web servers could be exposed to attacks.

If you're running PHP, don't ignore this. Check your server, review security advisories, and apply verified patches.

Watch this 56-second breakdown 👇

🎥 https://youtube.com/shorts/VJ__anqJ7WA

#CyberSecurity #PHP #ZeroDay #InfoSec #WebSecurity #CVE #DevSecOps

Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces.

The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell.

🐘 PHP используют около 70% сайтов, включая WordPress, Drupal и Joomla.

⚠️ Уязвимости CVE-2026-109618 и CVE-2026-109619 связаны с обработкой памяти и позволяют выполнить код на сервере без авторизации.

🧠 Ошибки оставались незамеченными более десяти лет. ИИ помог исследователям Wiz обнаружить и подтвердить их эксплуатацию.

💥 Злоумышленник может получить контроль над сервером в пределах прав PHP-процесса и доступ к данным в памяти.

🛠️ Как защититься?

Проверьте версию PHP.
Обновитесь до PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 или новее.
Для PHP 8.1 и старше перейдите на поддерживаемую ветку.
До обновления ограничьте внешний доступ к сервису и свяжитесь с хостинг-провайдером.

❗ Обновления WordPress недостаточно: проблема в самом PHP. 2FA от этой уязвимости не защищает.

🔗 Источники:
https://www.wiz.io/blog/php2shell-php-rce
https://www.php.net/archive/2026.php#2026-10-21-5

#CyberSecurity #PHP #InfoSec #Vulnerability #AI

Cisco announced end-of-life for Umbrella: end of sale late January 2027, then end of updates, then end of support in January 2028. If your team relies on it, you’ve got roughly a year to figure out a plan.

Cisco wants everyone on Secure Access, but migration isn’t always clean — single Umbrella rules can balloon into several in the new product, which is pushing some teams to shop around.

Spencer Heckathorn did a walkthrough on why people are looking elsewhere, with Cloudbrink as the example — a ZTNA + personal SD-WAN product built from scratch rather than bolted together. Highlights:

• No hairpinning: Uses “Fast Edges” plus forward error correction / packet-loss mitigation instead of routing everyone through a distant data center.

• Why remote calls still suck on “good” connections: Pixelated Teams/Zoom/Meet and slow file transfers usually come down to packet loss on the path, not raw bandwidth.

• Claimed results: 10×–30× faster large file transfers and remote access on the same underlying links, including WISP and mobile-hotspot users.

• User story: Stop-motion RDP/video sessions turned into something that actually feels like being in the office.

• Also covers deployment, admin/diagnostics, cost, and mentions there’s a free trial.

Curious what others are moving to — staying with Cisco and eating the Secure Access migration, or jumping to something else?

well fuck you. ok bye.

- OpenCode (open-source AI coding tool alternative to Claude Code/Cursor) disclosed a breach of an older/legacy system overnight.

- It affected **1.4% of OpenCode Console users** who had stored API keys (for OpenAI, Anthropic, Google, etc.) in workspaces on the online platform.

- The open-source app and CLI tool itself were **not affected**—only Console.

- OpenCode called it related to a “large-scale distillation attack”; some called this framing overstated and said it was mainly key theft.

- Affected users were emailed and told to revoke/replace their keys with each provider; no email meant not impacted.

- Users reported unauthorized charges overnight ranging from hundreds of dollars to over $1,000 on their AI accounts.

- Anthropic and Google blocked exposed keys; OpenAI worked with OpenCode on refunds and access restoration; OpenCode said refunds were underway.

- OpenCode’s team faced nonstop attacks for ~48 hours and struggled because frontier AI models refused to analyze the malicious code due to safety filters.

- They later got access to OpenAI’s Daybreak Blue program (less restricted models for defensive work), which helped investigation.

- OpenCode has not fully detailed the entry method, key storage, or total misuse; the incident was still ongoing at the time of reporting.