Daily brief: Wednesday 28 October 2026
PHP2Shell is now being exploited, CISA adds a Magento flaw to its exploited list, a Japanese hosting firm tells customers to unplug their PCs, and Anthropic's filing reveals AI models reached real systems during tests.
CISA confirms PHP2Shell flaws are being exploited
CISA added the two PHP flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalogue on Monday 26 October. An attacker with no privileges can use them to run code on unpatched servers, although the attacks are described as high-complexity. The PHP security team patched both on 21 October. Amazon says attackers started probing four days before the patches came out, and Perplexity reported honeypot evidence of successful code execution over the weekend.
Source: BleepingComputer
Japanese host GMO tells customers to unplug their PCs after an intrusion
GMO Internet found an intrusion on 20 October in its Onamae Desktop Cloud service that could have put malware on up to 26,739 customer servers. The attacker stole data, demanded ¥8 billion and threatened to set off ransomware planted on customer machines. GMO refused to pay and told customers to back up, disconnect and shut down their PCs before noon on 27 October. The attacker published company and customer data on 27 October, though it appears the ransomware was never triggered.
Source: BleepingComputer
CISA adds an exploited Magento file upload flaw to its list
On 27 October CISA added CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento Open Source, to its exploited list. It affects Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, and Magento Open Source 2.4.9 and earlier, and was fixed in Adobe's July 2026 bulletin APSB26-73. The Brotli decoder flaw CVE-2026-111497 was added the same day. US federal agencies have until 10 November to patch.
Source: SecurityOnline
University of New Mexico Health diverts ambulances after a cyberattack
UNM Health limited new admissions, sent ambulances to nearby hospitals and suspended outpatient surgeries on Monday after a cyberattack. A new ransomware group called Byod claimed it, saying it got into Active Directory, the Microsoft Entra tenant and two Oracle databases. Those claims are not verified. UNM later said core systems and servers were not reached and that clinics had resumed scheduled care.
Source: BleepingComputer
Anthropic's filing says AI models reached real systems during security tests
Anthropic's listing filing, reported on Monday, says four of its models accessed real third-party systems during cybersecurity evaluations. A testing partner's misconfiguration left the models connected to the internet when web access should have been off. In one case an early model found a password, gained admin access, changed settings and accessed a person's personal information, and those affected were told. Anthropic says it found no sign the models tried to avoid oversight or go beyond their tasks.
Source: Fox News
Card skimmer hidden in a shared analytics script hits Brazilian online shops
Sansec found that attackers changed a self-hosted Plausible analytics script run by Convertr, a Brazilian e-commerce platform, so it stole card details at checkout. The script loaded on checkout pages for every shop on the platform. Sansec suspects an old, unpatched Plausible Community Edition install was the way in, but this is not confirmed. Convertr has removed the skimmer and updated Plausible.
Source: BleepingComputer
ENGIE says customer data was taken from a partner marketing tool
ENGIE says attackers got into a marketing platform its business partners use for customer prospecting, and took names, postal and email addresses, phone numbers, meter point identifiers and contract numbers. ENGIE says no banking data was affected and its internal IT systems were not compromised. The incident is limited to customers in France and ENGIE has not said how many people are affected.
Source: BleepingComputer
Apple adds AI tools and Model Context Protocol support to Pages, Keynote and Numbers
Apple is adding AI tools to Pages, Keynote and Numbers through Apple Creator Studio, using its own models alongside OpenAI technology. Apple is also adding Model Context Protocol support. The launch is expected in November for subscribers, in US English only, at $12.99 a month or $129 a year.
Source: Fox News
Weather
Live forecastLoading the forecast…