Daily digest,
China-linked Storm-0940 Breaches ConnectWise Backup Service Using AI… (+7 more)
Vulnerabilities
Critical PHP2Shell Vulnerabilities Expose Millions to Remote Code Execution
On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws allow unauthenticated attackers to execute arbitrary code on PHP servers, affecting versions from 5.4 to 8.5. The vulnerabilities stem from memory management issues during out-of-memory conditions and improper handling of request states. Attack attempts were observed shortly before the patches were released, indicating active exploitation in the wild. Organizations are urged to update PHP immediately, as configuration changes cannot fully mitigate the risks. The vulnerabilities carry a CVSS score of 9.2, highlighting their severity and potential impact on approximately 70% of the internet's web applications.
Vulnerability · 20 sources · score 73 · CVE-2019-11043, CVE-2024-4577, CVE-2026-109618, CVE-2026-109619, CVE-2026-111497
Critical PHP Vulnerabilities CVE-2026-109618 & CVE-2026-109619 Exploited in the Wild
On October 21, 2026, PHP released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. These vulnerabilities allow unauthenticated remote code execution (RCE) through PHP's handling of request data. Following the disclosure, numerous GitHub repositories named 'php2shell' emerged, with 99 out of the top 100 addressing these vulnerabilities. Security firm WatchTower reported actual exploitation attempts on its honeypot network, indicating that the vulnerabilities are actively being targeted. PHP has advised that updating to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only complete mitigation. The vulnerabilities affect all PHP versions from 5 onward, particularly in mod_php environments. As of now, the vulnerabilities have not been listed on the CISA KEV list.
Vulnerability · 9 sources · score 73 · CVE-2019-11043, CVE-2024-4577, CVE-2026-109618, CVE-2026-109619
Critical RCE Vulnerability in Meta React Server Components Discovered
CVE-2025-55182 is a critical remote code execution vulnerability in Meta React Server Components, with a CVSS score of 10.0. It allows unauthenticated attackers to execute arbitrary commands on the server by sending crafted JSON payloads. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on December 5, 2025, indicating active exploitation in the wild. Affected versions include react-server-dom-webpack and react-server-dom-esm from 19.0.0 to 19.2.0. The exploit can lead to full server compromise, as it executes commands with the privileges of the Node.js process, often as root. Organizations are urged to confirm their exposure and implement remediation strategies, including applying vendor patches and reducing internet exposure. As of October 2026, the vulnerability remains a significant concern for users of React Server Components.
Vulnerability · 2 sources · score 70 · CVE-2020-1350, CVE-2025-55182, CVE-2025-66478
Ransomware
SafePay Ransomware Hits 600+ Organizations Worldwide
The FBI, CISA, and U.S. Secret Service issued a joint advisory on October 20, 2026, warning that the SafePay ransomware group has compromised at least 600 organizations globally since August 2024, affecting critical infrastructure sectors. SafePay employs various attack vectors, including credential theft, brute-force attacks, and exploiting vulnerabilities in VPNs and edge devices. Specific vulnerabilities exploited include CVE-2020-3259, CVE-2023-27532, and CVE-2024-40711. The group operates a double-extortion model, stealing data before encrypting systems and threatening to publish the stolen information if ransoms are not paid. The advisory provides detailed tactics, techniques, and procedures (TTPs) for defenders to mitigate risks. Authorities emphasize the urgency of patching known vulnerabilities and implementing multifactor authentication to protect against these attacks.
Ransomware · 7 sources · score 74 · CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, Alphv/Blackcat
Breaches
China-linked Storm-0940 Breaches ConnectWise Backup Service Using AI Tool
China-aligned hacker group Storm-0940 compromised ConnectWise's Cloud Backup service, targeting hundreds of organizations globally. Utilizing the AI-driven penetration testing framework ARTEX, the group automated attacks that achieved privileged access in many cases. Microsoft reported that the attack began in September 2026, with Storm-0940 executing over 2,250 tenant logins at a rate of 2,900 attempts per minute. While many attack attempts were unsuccessful, the hackers established persistent access to cloud environments across various sectors, including defense and finance. ConnectWise has since suspended its Cloud Backup service and is in the process of restoring affected accounts. The incident highlights the risks associated with third-party technology providers and the potential for widespread impact from a single compromised credential.
APT · 6 sources · score 76 · Storm-0940
Railway Security Incident: Unauthorized Access to Environment Variables
On October 21, 2026, Railway reported anomalous activity indicating that an unauthorized third party may have accessed encrypted environment variables, potentially exposing sensitive data like API keys and credentials. The company is investigating the incident and has paused all deployments as a precaution. Users are advised to revoke all stored environment variables and review service logs for unusual activity. Railway has notified upstream providers to revoke keys proactively. While the initial analysis suggests limited impact, all users are urged to take precautionary measures. The incident is part of a broader trend of attacks targeting platform companies involved in AI inference. Railway is providing updates on the situation as it develops.
Breach · 2 sources · score 61
Data Breach at The Money Store Exposes Sensitive Customer Information
The Money Store, operated by MLD Mortgage Inc., reported a data breach that began on September 8, 2026, when an unauthorized third party accessed its systems via a remote monitoring platform used by a third-party service provider. The breach was identified on September 9, 2026, and a ransomware group named Storm claimed responsibility on September 21, threatening to publish 229 GB of stolen data. The exposed information includes names, Social Security numbers, driver's license numbers, and financial details. The company has begun notifying affected individuals and is offering identity theft protection services. As of October 15, 2026, 1,367 Texas residents have been reported affected. The breach has been reported to the Attorneys General of California and Texas.
Malware · 2 sources · score 58 · Storm
Toronto Crime Stoppers Halts Tip Submissions After Data Breach
Toronto Crime Stoppers has suspended accepting tips due to a data breach affecting its third-party software, P3. The breach, which occurred in March 2026, resulted in the theft of approximately 176,859 tips submitted between January 2022 and November 2025, along with 14,973 associated names. Sean Sportun, the chair of Toronto Crime Stoppers, stated that they were initially informed by Navigate360, the software owner, that the system was secure and that no Toronto data had been compromised. It wasn't until June that they learned about the breach's impact on Toronto data. The organization has removed its 'Tip Submit' feature and advised the public to report tips directly to the Toronto Police Service. They are currently working on a safer method for tip submissions. The charity expressed regret for violating the anonymity promise to those whose information was compromised.
Breach · 2 sources · score 52
New on leak sites
42 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2024-4577, CVE-2019-11043, CVE-2023-27532
- Vulnerabilities: Heartbleed, Path Traversal, Authentication Bypass Via Hardcoded Default Secrets
- Ransomware groups: Inc Ransom, Qilin, Akira, Alphv/Blackcat
- Campaigns: Storm-1516, Cambridge Analytica Scandal, Cascade Hole, Chase Fraud & Scam Prevention Month, Classiscam
- Malware: XWorm, AsyncRAT, CanisterWorm, ClawdBot, ClawHavoc
- APT groups: APT29, APT41, Bronze Atlas, Bronze President, Bronze Sandcastle
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.