Vulnerabilities & remediation
The 4 selected developments in vulnerabilities & remediation put vulnerabilities & remediation on the week's review agenda. CISA Adds Two Known Exploited Vulnerabilities to Catalog; Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces; WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours; CISA says max severity GitLab flaw now exploited in the wild. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA reports: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose…
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
The Hacker News reports: Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory.
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
The Hacker News reports: Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system.
CISA says max severity GitLab flaw now exploited in the wild
BleepingComputer reports: Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
Cybercrime & Fraud
The 2 selected developments in cybercrime & fraud put cybercrime & fraud on the week's review agenda. Northflank security breach leads to abuse of customers' AI API keys; Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Northflank security breach leads to abuse of customers' AI API keys
BleepingComputer reports: Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data
The Hacker News reports: American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens.
Cloud, Identity & SaaS
The 1 selected development in cloud, identity & saas put cloud, identity & saas on the week's review agenda. Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
The Hacker News reports: Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026.
Ransomware & Extortion
The 1 selected development in ransomware & extortion put ransomware & extortion on the week's review agenda. Japan's GMO urges customers to shut down PCs amid ransomware threat. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Japan's GMO urges customers to shut down PCs amid ransomware threat
BleepingComputer reports: The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today.
- Prioritize exposure checks and patch planning because these stories usually point to weaknesses defenders can reduce quickly.
- These items often reveal how attackers monetize access, so they are useful for tuning detection and user-facing controls.
- Identity and cloud stories usually deserve a configuration review because small permission mistakes can become broad exposure.
- Treat these as resilience stories: backup integrity, identity hardening and incident communications matter as much as prevention.