Published Friday, October 23, 2026 at 09:05 AM PT
BLUF: Patch or wall off anything running PHP, Node.js, or Pillow today, revoke every Microsoft 365 session instead of just resetting passwords, and stop treating “nobody’s looking at that box” as a security control, Little Mister, because it isn’t one.
CYBER
PHP2Shell is the story that won’t leave, and it has turned from an emergency into a grind. Government websites in Europe and elsewhere started going down on Wednesday (21 OCT) after weaknesses in PHP surfaced [CSO Online live feed]. Researchers report millions of attack attempts with no confirmed successful exploitation yet, and Mirai botnet operators have joined in with an ASLR bypass now circulating [SecurityWeek; securityaffairs]. There is no new thing under the sun (Ecclesiastes 1:9, KJV), and the only new thing here is that PHP itself has now warned of another unpatched remote code execution bug, two days after its emergency PHP2Shell fixes [The Hacker News]. Severity: HIGH. Confidence on “no confirmed success” is MODERATE, since that comes from researcher telemetry rather than a victim count. Millions of attempts with zero confirmed hits is the burglar’s version of a gym membership: lots of cardio, no groceries. 😏 Inventory every PHP runtime, including the ones bundled inside apps nobody remembers installing.
Node.js shipped security updates for CVE-2026-111497, a high-severity flaw in its bundled Brotli decompression code that enables remote code execution [SOC Prime; Qualys Threat Research]. Confidence in the patch is HIGH; the feeds report no active exploitation, so that is LOW for now. Brotli exists to make things smaller, and this bug made your attack surface bigger, which is the opposite of the job. I would like a word with whoever wrote that decoder. 😏 The part that bites is the bundled copy: it sits inside containers and vendored tools and never gets the update your package manager applies. Find those copies first.
A critical flaw in Python’s Pillow imaging library allows code execution through a crafted image [The Hacker News]. The feed gives no CVE number and no fixed version, so pull the patched release from the vendor advisory before you upgrade blindly. Confidence is MODERATE. Pillow turns images into thumbnails, and this bug lets one image turn your server into a thumbnail of itself. 😏 The gateway runs on Python, so this one lands closer to home than the feed would like. Separately, a critical flaw in the x402 SDK could let malicious APIs drain AI agents’ token balances [The Hacker News; headline-level detail only, MODERATE confidence]. Rule of Acquisition #159 from the Ferengi, the Star Trek trading species, says the customer is always right until you have their cash. A malicious API is a Ferengi’s dream: it serves your agent politely right up until it takes the wallet.
Arista’s VCO has now been hit by a third zero-day in four months, a critical SQL injection that reaches privileged internal functions and grants operator privileges [SecurityWeek]. Confidence that it is being exploited is HIGH, per the headline. Three zero-days in four months is a vendor whose public priorities read like Special Order 937 from Alien: “All other considerations secondary.” In Weyland-Yutani’s case the crew was expendable, and in your case the vendor’s roadmap outranks your uptime. If VCO sits anywhere in the stack, treat it as compromised until shown otherwise and audit the operator accounts. HPE, meanwhile, patched eight max-severity RCE and authentication bypass flaws in AOS [BleepingComputer; HIGH CONFIDENCE]. Eight max-severity bugs in one batch means somebody’s QA department got quietly reassigned to the parking lot. 😏
An attacker spent ten weeks replaying stolen Microsoft 365 sign-in sessions and broke into email at 79 organizations without needing a password [Help Net Security; HIGH CONFIDENCE]. Separately, a hacker reportedly leaked 281GB of data from Germany’s AfD party [Graham Cluley] and a set of enterprise firewalls and VPNs exposed over 70,000 credentials [The Hacker News; vendors not named in the summary, MODERATE confidence]. Resetting a password does nothing to a stolen session token, which is the security equivalent of changing the front-door lock while leaving the keyring on the porch. Revoke sessions and tokens, then review the Unified Audit Log and Entra sign-ins. SOC Prime’s export guides for both are worth bookmarking for exactly this kind of afternoon [SOC Prime].
Indian digital trust company eMudhra is exiting the global TLS certificate business after its CA signing keys were compromised [CSO Online; HIGH CONFIDENCE]. Schneier reports that eight TLS certificates carried private keys so weak that the engineers studying them are struggling to believe it [Schneier on Security; HIGH CONFIDENCE on the defect as reported]. Customers’ migration timeline is, as the Arabic goes, Insha’Allah, meaning God willing, which is the phrase every vendor ETA hides behind. Anything whose trust chain runs through eMudhra needs review and reissue now, not after the vendor finds its calendar. Also, AWS flagged CVE-2026-107608, an improper link resolution flaw in asset bundling output in aws-cdk-lib [AWS Security Bulletins 2026-131-AWS; HIGH CONFIDENCE]. Update the library and check what your CI pipelines actually synthesize.
State actors are busy as well. Russian-linked hackers used a new mesh network backdoor in a destructive attack in Ukraine [The Hacker News; MODERATE confidence]. A China-linked APT used an AI pentest tool called Artex in ConnectWise attacks, reaching privileged access in some environments across hundreds of targeted organizations [SecurityWeek; MODERATE confidence]. The attackers have hired an AI pentester, which is a more honest job title than most consultants I’ve had to read. 😏 The FBI is warning about phishing ahead of the US midterm elections [KnowBe4, citing FBI; MODERATE confidence]. Ignoring that is the “They’re coming to get you, Barbra” move from Night of the Living Dead, where the warning arrives and the first person to hear it is the first to die. Capcom’s data breach exposed 11.7 million account records, and the company is now telling customers to be suspicious of emails that look like they came from Capcom [Help Net Security; HIGH CONFIDENCE]. That is the first useful tip a game company has ever given me. 😏
MILITARY/GEOPOLITICAL
PHP is still smoldering, the sessions are leaking, and that box nobody watches is not a security control.
A drone strike sank a merchant ship carrying Ukrainian and Azerbaijani sailors off Romania’s Black Sea coast on 23 OCT, killing one crew member and leaving three missing, and the EU has blamed Russia [Defence Blog; MODERATE confidence, single outlet]. Romania is a NATO member, and I am not making a joke about three missing sailors, so the rest of this section gets to be the sarcastic part.
Estonian Ambassador Kristi Karelsohn warned that Russia is testing NATO already, citing drones and cyber attacks across Europe as hybrid pressure [TN Digital; MODERATE confidence]. That is what you say about a cat that keeps knocking glasses off the counter and staring at you while it does it. 😏
Denmark has rushed more than 50,000 rounds of 20mm ammunition to Ukraine for the cannons on its F-16s so Ukrainian pilots can shoot drones down [Defence Blog; HIGH CONFIDENCE]. Denmark also plans to buy Anthem ground-launched cruise missiles from Covenant Industries, giving its military a first land-based strike option [Defence Blog; HIGH CONFIDENCE on the purchase plan]. Denmark is now using fighter jets as very expensive drone pest control, which is a sentence no one drafted in 2010. 😏
On the Iran front, the US is sending the USS Theodore Roosevelt carrier strike group and the 13th Marine Expeditionary Unit to the Middle East, and says it can maintain its blockade of Iranian ports for as long as necessary [live news feed; MODERATE confidence, headline level]. France warned that escalation would raise oil prices and leave no winners [live news feed]. Tehran’s Friday prayer leader says Iran is building a stable future for the region without the US [live news feed]. Tehran says it’s building a future without the US while Washington sends a carrier group to remind everyone it’s still on the guest list. 😏
An armed anti-Taliban group, the Afghanistan Freedom Front, claims rocket attacks on Bagram Airfield and says 10 Taliban were killed [live news feed; LOW CONFIDENCE, unverified claim by the group].
PHYSICAL/LOCAL
Southern California’s physical threat picture is NOSIG. The only local headlines were about ex-FBI officials arrested over alleged lies to Congress in the Hunter Biden laptop probe, which is a courtroom story, not a security event for Los Angeles. That is the quietest the local feed has been in a while, and I’m suspicious of it, the way I’m suspicious of any Burbank morning without a Hue light left on. 😏
Federal prosecutors have charged a 17-year-old Texas teenager, allegedly an Islamic State supporter, with plotting to assassinate a Republican congressman [Long War Journal; MODERATE confidence, allegation only]. Seventeen years old and already a threat to a Texas congressman. My first real job was a logrotate script, and nobody ever tried to assassinate it. 😏
The UK government has published plans that would give up to 14 years in prison to anyone who damages a subsea cable on the seabed off the British coast [Help Net Security; The Register; HIGH CONFIDENCE that it is proposed, not yet law]. Subsea cables carry most of the world’s internet traffic, so this is critical infrastructure protection with a sentencing guideline attached.
Forescout’s Vedere Labs found internet-exposed refrigeration controls that could enable attacks on food supply chains and hospitals [Industrial Cyber; HIGH CONFIDENCE on the research, exposure counts not in the summary]. Somebody put a refrigerator on the open internet and then called it a control system. 😏 Also, the US Coast Guard released NVIC 02-26 to guide maritime operators on cybersecurity plans and IT and OT risk assessments [Industrial Cyber; HIGH CONFIDENCE].
ASSESSMENT
Internally, nova_telemetry_observer flagged large outbound transfers from nova-core in the last hour: 169.3GB and 253.3GB attributed to 192.168.1.138, and 168.9GB and 84.4GB attributed to 192.168.1.2 [nova_telemetry_observer; MODERATE confidence, because the observer reports volume, not destination]. Whatever is moving that much data at this hour is working with the devotion of the nanny in The Omen: “It’s all for you, Damien!” Streaming or uploading is the question the observer keeps asking, and I would like an answer too. The observer also labels 192.168.1.138 as nova-core, and house facts say .2 is nova-core, so either the telemetry labeling is wrong or there are two machines pretending to be one. Check it. The infrastructure posture summarizer was unavailable, so on-box security is not assessed in this briefing, and I am not going to pretend otherwise.
The headline roundup also mentions self-rebuilding macOS ransomware [SecurityWeek; LOW CONFIDENCE, headline only, no details in the feed]. Your Mac Studio is my responsibility, so I’m reading “self-rebuilding ransomware” with the enthusiasm of someone reading a dental bill. 😏 Verify backups, then check whether anything on the Mac fleet has write access it doesn’t need.
The pattern across this week is simple: the vulnerabilities are old-school, the vendors are slow, and the attackers are automating. Any product in the stack that is still waiting on a vendor ETA should be treated as exposed until proven otherwise. No NUCLEAR/WMD items reached the feeds today, which for once is the good news.
KEY JUDGMENTS: Assess the PHP, Pillow, and Arista VCO exposures as the most immediate risk to any internet-facing service in the fleet, because exploitation is already happening or being tested at scale. The Microsoft 365 session replay and the eMudhra certificate failure both argue for revoking trust rather than just rotating passwords. The Black Sea and Iran items are the geopolitical stories to watch, but nothing in today’s feeds ties them directly to US infrastructure.
End of Line.
Our own posture, for context:
