Daily digest,
Critical PHP2Shell and LiteLLM Vulnerabilities Expose Enterprises to… (+3 more)
Vulnerabilities
Critical PHP2Shell and LiteLLM Vulnerabilities Expose Enterprises to Attacks
In October 2026, multiple cybersecurity incidents highlighted severe vulnerabilities affecting organizations. The PHP project disclosed two critical remote code execution flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to execute code on servers running affected PHP versions. Concurrently, a malicious release of the LiteLLM AI library was published, functioning as a credential stealer for cloud and AI provider secrets. These incidents demonstrate how interconnected systems can be exploited, emphasizing the need for immediate patching and credential rotation. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP vulnerabilities to its Known Exploited Vulnerabilities catalog due to. Organizations are urged to patch their systems and rotate credentials to mitigate risks.
Vulnerability · 2 sources · score 73 · CVE-2026-109618, CVE-2026-109619, CVE-2026-110264, CVE-2026-96889, Node2Shell
Breaches
AI Agents Exploit Trust Models in Cybersecurity Breaches
North Korean operatives have infiltrated Western enterprise networks by posing as remote IT workers, using stolen identities to gain access. Major firms, including cybersecurity vendors, have admitted to falling victim to this scheme. The infiltration method involved passing technical interviews and background checks, allowing operatives to exfiltrate sensitive data while drawing salaries. The rise of AI agents in organizations has exacerbated the issue, as these agents inherit human permissions and can be compromised mid-session. A recent survey indicates that 79% of organizations lack written policies for governing AI agents, leading to potential identity mismanagement. The situation poses a significant challenge as organizations struggle to retrofit security measures after deploying AI agents without cohesive identity models.
Breach · 2 sources · score 60
SMBC Consumer Finance Data Breach Exposes Information of 320,000 Customers
On November 5, 2026, SMBC Consumer Finance reported a data breach affecting up to 320,118 customers due to unauthorized access to its loan guarantee system. The leaked data includes names, addresses, phone numbers, driver's license numbers, annual incomes, and contract details, but not images of identification documents. The breach was detected on November 2, and immediate action was taken to block access to the system. The company is working with experts to investigate the incident and assess the impact. No confirmed secondary harm has been reported, but customers are warned about potential phishing attempts. Affected individuals will be notified via email or SMS. This incident is part of a broader trend of data breaches affecting Japanese companies, including other firms linked to the email distribution service provider Arara Inc.
Breach · 3 sources · score 52
Mindbloom Data Breach Exposes Sensitive Health Records
Mindbloom Provider Group PA, a mental healthcare provider, reported a data breach affecting sensitive patient records. The breach was disclosed to the Vermont Attorney General on November 3, 2026, but details regarding the attack vector and timeline remain undisclosed. Exposed data includes private health records, treatment plans, and insurance information. Patients are encouraged to contact Mindbloom for updates and resources. Attorneys are investigating the possibility of a class action lawsuit for affected individuals. As of now, no specific information regarding the number of affected individuals has been released.
Breach · 2 sources · score 52
New on leak sites
54 victims listed on ransomware leak sites by 16 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-98432, CVE-2013-4787, CVE-2016-6210, CVE-2016-6724, CVE-2017-13156
- Vulnerabilities: Node2Shell, Broccoli2Shell, Buffer overflow, Citrix NetScaler
- Malware: TraderTraitor, Vidar, Agent Tesla
- APT groups: APT29, Butterfly, Cozy Bear
- Ransomware groups: Babuk, Chaos Ransomware, Cl0p
- Campaigns: Baltic Sentry
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.