Home/Digest/Technology/Past issues
Technology digest,
Technology: Chinese Hackers Use AI to Breach ConnectWise, Targeting… (+6 more)
Vulnerabilities
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models.
APT · 20 sources · score 73 · CVE-2012-1823, CVE-2015-4024, CVE-2017-5340, CVE-2019-11043, CVE-2024-4577
Critical PHP Vulnerabilities Prompt Global Cybersecurity Alert
An emergency security update for PHP has been issued following the discovery of two critical vulnerabilities, collectively termed PHP2Shell, which could allow remote control of affected servers. These vulnerabilities impact approximately 70% of websites globally, including major platforms like WordPress and Drupal. The U.S. National Security Agency and FBI have issued warnings, advising immediate updates or taking vulnerable systems offline. Cybersecurity stocks surged in response, with Palo Alto Networks and CrowdStrike seeing significant gains. Researchers utilized advanced AI tools to identify these vulnerabilities, which had reportedly gone unresolved for years. The rapid evolution of AI is raising concerns about the speed at which vulnerabilities can be exploited, potentially shortening the response time for organizations. Authorities are urging website operators to act quickly to mitigate risks associated with these vulnerabilities.
Other Threats · 2 sources · score 72
Ransomware
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure
Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure on May 13, 2026, the vulnerability has been actively exploited, leading to unauthorized access to corporate networks across various sectors, including education, healthcare, and finance. Reports indicate that over 600 organizations have been affected by ransomware attacks linked to this vulnerability. Security experts recommend immediate patching and monitoring for signs of compromise, as attackers may have already established access before remediation. The situation is compounded by the rise of ransomware-as-a-service (RaaS) operations, which have increased the scale and impact of these attacks.
Ransomware · 20 sources · score 73 · CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
Ransomware Group n0n Threatens Backup Integrity in New Extortion Tactic
A new ransomware group named n0n has emerged, targeting organizations by threatening to encrypt or delete their backup infrastructure. First detected on September 18, 2026, n0n has already affected over a dozen organizations, primarily in the U.S., with victims from sectors including finance, technology, retail, and education. The group exploits stolen credentials from infostealer malware to gain initial access, escalating privileges to extort confidential data. Analysts note that while the group's threats are aggressive, there is currently no technical evidence that they can execute the promised destruction of backups. This tactic aims to psychologically pressure victims into paying ransoms by undermining the belief that backups are secure. Recommendations for organizations include improving credential hygiene and implementing immutable backup solutions. The situation remains dynamic as the group continues to expand its list of victims.
Ransomware · 2 sources · score 58 · N0n, Log4j
Breaches
Chinese Hackers Use AI to Breach ConnectWise, Targeting 2,250 Microsoft 365 Tenants
A Chinese state-aligned hacking group known as Storm-0940 exploited the ConnectWise Cloud Backup service to compromise over 2,250 Microsoft 365 tenants. Utilizing the ARTEX AI penetration testing framework, the attackers automated their operations, achieving privileged access in under three hours in some cases. The campaign, which began in September 2026, involved rapid sign-in attempts reaching 2,900 per minute, allowing the group to bypass multi-factor authentication by leveraging pre-authorized applications. Microsoft confirmed that the attack targeted various sectors, including defense, finance, and technology. ConnectWise has since disabled affected services and is in the process of restoring them, while advising customers to review their logs for unauthorized access. The incident highlights the growing threat of AI-driven cyberattacks and the vulnerabilities within third-party application integrations.
APT · 20 sources · score 78 · Storm-0940
Threat actors and malware
AI-Driven Cyber Espionage Campaigns Surge
In late 2025, a Chinese state group reportedly utilized Anthropic's AI tool, Claude Code, to orchestrate a cyber espionage campaign against approximately 30 organizations, including tech firms and government agencies. The AI framework enabled the group to automate up to 90% of the attack process, requiring minimal human intervention. The campaign exemplifies how AI tools can discover vulnerabilities and generate exploit code at speeds, often within hours of public disclosure. This shift in attack methodology presents significant challenges for defenders, who must now contend with the rapid pace of exploit development and the novelty of attack vectors. Agencies are advised to rethink their security strategies, focusing on proactive measures to address vulnerabilities as they emerge. The current landscape necessitates continuous adaptation in defensive policies and technologies to keep pace with evolving threats.
APT · 7 sources · score 76
Also worth knowing
Greece's Defense Minister Addresses Cybersecurity as National Security Concern
On October 21, 2026, Greece's Minister of National Defence, Nikos Dendias, emphasized the critical nature of cyberattacks on national infrastructure during his speech at the Cyber Greece 2026 conference. He highlighted the blurred lines between peace and war due to hybrid threats targeting essential services like energy, communications, and healthcare. Dendias introduced the 'Achilles’ Shield' framework, which includes five layers of defense and aims to unify the Armed Forces' information operations. He noted that artificial intelligence enhances the effectiveness of these hybrid threats. Concurrently, Dendias is visiting the US for discussions on cyber-defense and innovation, indicating a strategic shift towards advanced technologies in military operations. The ongoing developments are part of Greece's 'Agenda 2030' initiative to bolster national security against evolving cyber threats.
Critical Infrastructure · 2 sources · score 58
New on leak sites
28 victims listed on ransomware leak sites by 15 groups in the 7 days before this issue. The most active:
Get the next one by email
The technology digest is free and arrives on Tuesdays. One click to leave.
Subscribe to the technology digest
A free account turns the digest into a personal watchlist: choose what you want to follow.