Daily brief: Thursday 22 October 2026
Ransomware gangs are using a Palo Alto GlobalProtect flaw to reach VMware and backups, stolen UpdraftCentral keys are backdooring WordPress sites, PHP fixes are out after an OpenAI-led disclosure, and Cisco has published 14 advisories including a critical Expressway flaw.
Ransomware gangs use a PAN-OS GlobalProtect flaw to reach VMware and backups
Palo Alto Networks' Unit 42 updated its threat brief on CVE-2026-0257 on 20 October. The flaw is an authentication bypass in the GlobalProtect portal and gateway that lets attackers start VPN sessions, and attackers then bypass MFA. Unit 42 has seen them use RMM tools, RDP and SMB to move around, and in one case move from the VPN to vCenter, disable security controls on ESXi hosts and dump credentials from a domain controller's disk. It names the Qilin and Inc ransomware groups and says attackers have also chained access with a Veeam backup flaw, CVE-2023-27532.
Source: Unit 42 (Palo Alto Networks)
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft, the developer of the UpdraftPlus backup plugin, says its website was accessed without permission over the weekend of 17 to 18 October. It believes the attacker reached its customer database, including UpdraftCentral connection keys. Patchstack says attacks started on 18 October, using the keys to run code and add admin accounts, and it has logged at least 99 backdoor plugins with names like "Site Health Cache". The fix is UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium); an earlier 26.12 release had a bug that stopped it removing the keys.
Source: BleepingComputer
OpenAI sets out how the PHP flaws were found and fixed
On 21 October OpenAI published "Patch the Planet", describing a coalition it led around two critical PHP vulnerabilities. It says Calif found one flaw using an OpenAI model and Wiz independently found and reported both, while PHP's maintainers led the fixes and release. OpenAI has shared a version checker as a Codex skill and proposed a five-stage framework for handling flaws in widely used software. It also says it has committed $1 billion of subsidised access to its security tooling for under-resourced defenders.
Source: OpenAI
Cisco publishes 14 advisories, including a critical Expressway flaw
Cisco's PSIRT published 14 advisories on 21 October covering Snort 3, Expressway, Unified Communications Manager, IOS XR on ASR 9000 routers and Secure Client. Three are rated critical, including a remote code execution flaw in the Expressway Series with a CVSS score of 9.8. Cisco strongly recommends upgrading to the fixed software listed in each advisory.
Source: Cisco
Japanese VPS provider shuts down customer servers after a hack
GMO Internet confirmed on 20 October that a third party installed malicious programs in some customer environments on its Onamae Desktop Cloud VPS service. Up to 26,739 servers are affected, and the company began shutting customer servers down from 04:00 local time on 21 October with no restart date. It says payment data is stored separately and is not affected, and has told customers to rotate any passwords or secrets stored on their servers.
Source: BleepingComputer
Fake AI tool install pages trick users into pasting malware commands
A sponsored BleepingComputer article from Push Security says ClickFix attacks now use cloned install pages for AI tools such as Claude Code and Codex, where the clipboard gets a malicious command. It also reports abuse of shared ChatGPT and Claude chats and artifacts to host lures on trusted domains. ANY.RUN linked 1,258 sandbox analyses to fake AI tool campaigns between April and early October, and Microsoft is quoted as saying ClickFix grew about 23 times between December 2025 and May 2026. The piece is vendor-written, so treat its own figures with care.
Weather
Live forecastLoading the forecast…