PHP2Shell Flaws Patched, Japan Cyberattack Emergency, Backup Software Backdoor

Last week was one of the busiest of the year for security teams. A critical PHP flaw put millions of websites at risk, a wave of attacks pushed Japan’s government into emergency mode, and several supply-chain compromises hit software that people trust by default.

Critical PHP flaws (PHP2Shell) patched in emergency release!

PHP published emergency fixes on 21 October for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which together are nicknamed PHP2Shell. Both let an unauthenticated attacker run code on a web server with a crafted request, and proof-of-concept code began circulating after details leaked a day early. Users are urged to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away. Read the BleepingComputer report

Japan declares an emergency response to a wave of cyberattacks!

Prime Minister Sanae Takaichi ordered her cabinet to draw up emergency countermeasures on 26 October, after a run of attacks that have rocked Japan in recent weeks. Earlier, the ruling party had proposed a dedicated headquarters to counter cyberattacks, and the government said it would step up measures across ministries after a series of personal data breaches. Read Bloomberg’s coverage and the government’s response on 23 October

Popular backup software used to push a backdoor!

Google disclosed a campaign against AOMEI Backupper, a Windows backup tool that AOMEI says is used by more than 186 million people. Between April and July, attackers briefly swapped AOMEI’s update files for malicious ones, in windows of just five to ten minutes, and any machine that checked for updates during those windows received a backdoor. No software vulnerability was needed, and AOMEI’s server fix does not clean machines that were already infected. Read BleepingComputer’s report

Quest Diagnostics confirms patient records were exposed!

Quest Diagnostics learned on 21 October that someone had accessed its Quanum Lab Services Manager, a platform clients use to place test orders and look up results. The company believes certain patient records were accessed, but it has not yet said how many people are affected or what data was taken. It disclosed the incident to the SEC, and the AP reported that Quest confirmed the breach is not related to the PHP issue. Read BleepingComputer’s report

Siemens confirms exploitation in ClickFix attacks!

Siemens disclosed on 19 October that attackers are exploiting CVE-2026-110936, a DLL sideloading flaw in its Software Center app. Criminals packaged a genuine, signed copy of the app with malicious DLLs, then tricked users into running the payload through ClickFix lures. Siemens fixed the flaw in version 4.0.9.8. Read the Infosecurity report

WordPress backup plugin maker breached, sites backdoored!

Attackers breached the website of TeamUpdraft, the developer of the UpdraftPlus backup plugin, around 17 to 18 October. They stole connection keys for UpdraftCentral and related services, then used them to install backdoor plugins and create administrator accounts on connected WordPress sites. Around 400,000 sites may have been exposed, and updating the plugin alone does not remove a backdoor that is already installed. Read BleepingComputer’s report

Popular AI proxy library poisoned with credential-stealing malware!

LiteLLM, an open-source Python library used to route requests to AI model providers, had its release pipeline compromised on 21 October. A malicious version, 1.107.0, was published to PyPI and Docker for a short time, and it contained malware that steals credentials. Anyone who installed it should downgrade to 1.106.2 and rotate any API keys, cloud credentials and developer tokens on the affected machine. Read BleepingComputer’s report

Node.js ships security fixes for ten CVEs!

The Node.js project released security updates on 21 October for its 22, 24 and 26 release lines. The most serious issue is a high-severity Brotli decoder flaw (CVE-2026-111497) that can lead to remote code execution. Three other high-severity flaws allow TLS hostname checks to be bypassed. Users should upgrade to 26.12.1, 24.22.1 or 22.23.4. Read the Node.js security release notes

Private keys for eight certificate authority intermediates were compromised!

Researchers reported on 17 October that the private keys for eight intermediate certificates from India’s eMudhra were weak enough to recover, which would let an attacker issue trusted certificates for any website. Mozilla and Chrome confirmed the problem on 20 October and moved to block the affected certificates. eMudhra says the keys were created during a April 2025 ceremony, that its root keys were not affected, and it is leaving the global SSL certificate business. Read CSO’s report

North Korean group Lazarus targets South Korean firms with a new campaign!

Kaspersky published details on 21 October of Operation FlashHole, a Lazarus espionage campaign that has been running since July 2025. It has hit at least three South Korean organisations in construction, software and telecom equipment. The attackers used phishing, a fake GitHub Pages site and a legitimate Korean security plug-in, and they encrypted parts of the malware with post-quantum cryptography. Read BleepingComputer’s report

Japanese web firewall flaw exploited to take over servers!

Attackers are exploiting CVE-2026-106931, a command injection flaw in SiteGuard Server Edition, a host-based web application firewall from Japan. The flaw lets attackers run commands with root or SYSTEM privileges, and it sits in a statistics feature that is enabled by default. Reports from 19 October warned that patching can erase forensic evidence, so administrators should capture logs first. Read Security Affairs’ report

Staffing platform Bullhorn taken offline after a cyberattack!

Bullhorn, a cloud platform used by more than 10,000 staffing firms, detected a cyber incident on 17 October and took its platform offline to contain it. Customers reported disruption to job postings and onboarding for several days, and parts of the service were restored later in the week. Bullhorn has not confirmed whether any customer data was stolen. Read BleepingComputer’s report

Nextcloud servers backdoored through a critical Collabora flaw!

Attackers have been exploiting CVE-2026-110447, a critical command injection flaw in the built-in CODE server app for Nextcloud, since 10 September. They plant PHP web shells that survive a restart. Disabling the app does not close the hole, so administrators should update the app to 26.4.303 or later and check their servers for web shells. Read eSecurity Planet’s report

Meta smart glasses reportedly recorded conversations without the wake phrase!

Several Ray-Ban Meta owners reported that their glasses captured conversations without the “Hey Meta” wake phrase, with some saying the feature was switched off. Meta says the problem has been resolved, though it has not fully explained what caused it. The reports have renewed concerns about recording bystanders without their consent. Read Malwarebytes’ report

These incidents also highlight the importance of strong email security. Implementing DMARC, DKIM, and SPF helps organizations reduce email spoofing and phishing risks as part of a broader cybersecurity strategy.