Weekly recap: Week of 19 to 25 October 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
310 stories tracked; +25 vs prior week; 8 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) additions; 285 ransomware leak-site claims observed in tracked feeds (unverified)
Monday to Sunday, Coordinated Universal Time (UTC). Permalink label: 2026-W43.
The 310 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded. The daily archive counts by the day the tracker first saw each story and does not require a summary or a why-it-matters line: its 7 day pages for these 7 days list 457 stories. The two figures use different dates and rules, so they are not expected to match.
Most covered
- vulnerabilities36 sources2026-018: Critical Vulnerabilities in PHPSource ↗
The PHP Foundation announced two critical vulnerabilities in PHP on October 20, 2026, that could enable remote code execution. Technical details remain undisclosed pending the scheduled security release on October 21, 2026, at 14:00 UTC. CERT-EU recommends…
Grouped: the same event, confirmed by the daily automated review.
- vulnerabilities7 sourcesSomeone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedSource ↗
Amazon's Threat Intelligence team detected an exploitation attempt against PHP2Shell vulnerabilities on October 17, 2026, four days before public disclosure. The attack came from an IP address associated with a commercial anonymization network and targeted…
Grouped: similar headlines.
- ransomware5 sourcesQilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFASource ↗
Palo Alto Networks continues to observe active exploitation of CVE-2026-0257, a CVSS 7.8 authentication bypass flaw in PAN-OS and Prisma Access that allows attackers to establish unauthorized virtual private network (VPN) connections. Ransomware groups Qilin…
Grouped: similar headlines.
- vulnerabilities4 sourcesNew PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619Source ↗
Searchlight Cyber released php2shell-scanner, an open-source tool for testing exposure to CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities patched on October 21. These remote code execution flaws affect PHP applications on Apache mod_php…
Grouped: the same Common Vulnerabilities and Exposures (CVE) records (CVE-2026-109618, CVE-2026-109619).
- vulnerabilities3 sourcesPHP Vulnerability Wrap-UpSource ↗
A PHP vulnerability triggered coordinated disclosure with timely patches from multiple vendors, though some disclosed details early. Public exploit code has not yet materialized reliably, though Cloudflare and Amazon report seeing exploit attempts. The…
Grouped: similar headlines and the same name (THE PHP).
- vulnerabilities2 sourcesNCSC-2026-0453 Vulnerability in Google Brotli decoderSource ↗
Google patched a vulnerability in the Brotli decompression library, which is used in Node.js and other software. An unauthenticated attacker can exploit this flaw remotely by processing specially crafted Brotli-compressed data, potentially causing denial of…
Grouped: similar headlines.
- vulnerabilities2 sourcesPHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingSource ↗
Threat actors exploited CVE-2026-109618 and CVE-2026-109619 in PHP2Shell to compromise a European government entity, gaining access to password hashes and multifactor authentication (MFA) credentials within two hours. Attackers are using agentic artificial…
Grouped: the same Common Vulnerabilities and Exposures (CVE) records (CVE-2026-109618, CVE-2026-109619).
- vulnerabilitiesHow CVE-2026-73570 turns a Zimbra log file into remote code executionSource ↗
CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra that allows attackers to gain remote code execution by sending a malformed SMTP recipient address. The vulnerability exploits a logging mechanism where Swatchdog, Zimbra's…
- vulnerabilitiesRapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Source ↗
Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance in early October 2026, revealing attackers chained CVE-2026-88771 and CVE-2026-88779 to achieve root execution and establish persistent access. The intrusion deployed PHP web…
- vulnerabilities19th October: Threat Intelligence ReportSource ↗
Check Point researchers disclosed critical vulnerabilities in LiteLLM that could enable administrative takeover or remote code execution (RCE), while Microsoft released 1,413 patches including an actively exploited Windows Shell flaw. High-profile breaches…
Most active ransomware groups (leak-site claims, unverified)
| N0n | 49 claims | -38 vs prior week |
|---|---|---|
| Qilin | 34 claims | +4 vs prior week |
| Leakeddata | 11 claims | +11 vs prior week |
| Lamashtu | 10 claims | +10 vs prior week |
| Silentransomgroup | 10 claims | +10 vs prior week |
| Emperador | 9 claims | +5 vs prior week |
| The Gentlemen | 9 claims | -36 vs prior week |
| Whitearmor | 9 claims | +9 vs prior week |
| Akira | 8 claims | -2 vs prior week |
| Brain Cipher | 8 claims | +7 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
Takedowns and arrests
- Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. CitizensExtradition · U.S. Department of Justice
A Chinese national made his initial court appearance today after being extradited from the Netherlands for his alleged role in an international cryptocurrency investment conspiracy carried out from scam centers in the Kingdom of Cambodia that targeted 174 identified U.S. citizens.
- What We Missed: Feds Lasso Texas Laptop FarmsDisruption · Dark Reading
Federal authorities disrupted North Korean infrastructure operations within the United States as part of "Operation Lonestar Justice." The item also notes a separate incident involving Staples gift card distribution. The piece is a roundup video covering news stories that the editors did not report on in depth.
- Africa cybercrime crackdown nets 1,462 arrests and over $105 millionArrest · Help Net Security
INTERPOL coordinated a cybercrime sweep across 21 countries, primarily in Africa, from June 29 to August 31, 2026, resulting in 1,462 arrests and the dismantling of 10,909 malicious networks. Investigators recovered more than $105 million in illicit funds and identified over 65,900 victims of fraud, ransomware, business email compromise, and digital extortion schemes that caused losses exceeding $385 million.
- Netherlands Police reports cyber enforcement: arrest, takedown (2026-10-22)Arrest · Takedown · Netherlands Police
- Netherlands Police reports cyber enforcement: takedown (2026-10-21)Takedown · Netherlands Police
- Netherlands Police reports cyber enforcement: arrest (2026-10-21)Arrest · Netherlands Police
- Hacker gets 8 years for stealing $3.3 million from taxpayersSentencing · BleepingComputer
A Nigerian national received an eight-year prison sentence for conducting spearphishing attacks against US tax preparation businesses starting in 2019, resulting in $3.3 million in theft from taxpayers. The attacks targeted organizations handling sensitive financial data and tax information.
- Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft SchemesSentencing · Guilty Plea · U.S. Department of Justice
United States Attorney for the Southern District of New York, Jamie McDonald, announced that CHUKWUEMEKA VICTOR AMACHUKWU, a/k/a “Chukwuemeka Victor Eletuo,” a/k/a “So Kwan Leung,” was sentenced by U.S. District Judge Paul G. Gardephe to eight years in prison for his role in multiple fraud, hacking, and identity theft offenses. AMACHUKWU previously pled guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud.
- Former Shelton Resident Sentenced for Computer Intrusion SchemeSentencing · U.S. Department of Justice
BILLIE CONLEY JR., 47, formerly of Shelton, was sentenced today by U.S. District Judge Victor A. Bolden in New Haven to nine months of imprisonment and three years of supervised release for operating a computer intrusion scheme.
- Uzbekistan man pleads guilty to his role in cryptocurrency schemeGuilty Plea · U.S. Department of Justice
U.S. Attorney Michael DiGiacomo announced that Nikita Andreevich Sklyuev a/k/a Valeriy Dorojkin, 39, of Uzbekistan, pleaded guilty before U.S. District Judge Richard J. Arcara to wire fraud, which carries a maximum penalty of 20 years in prison and a $250,000 fine.
CISA KEV additions
| CVE | Vendor and product | Federal fix deadline |
|---|---|---|
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | |
| CVE-2026-96656 | Plex Media Server | |
| CVE-2026-96654 | Plex Media Server | |
| CVE-2026-110936 | Siemens Software Center | |
| CVE-2026-96652 | Plex Media Server | |
| CVE-2026-96655 | Plex Media Server |
Vulnerabilities on the move, to (the 7 days before this recap was generated)
| CVE | Vendor and product | What changed |
|---|---|---|
| CVE-2026-88772 | Citrix NetScaler | EPSS exploit likelihood up 77 percentage points (0.78 now) |
| CVE-2026-88771 | Citrix NetScaler | EPSS exploit likelihood up 81 percentage points (0.82 now) |
| CVE-2026-45659 | Microsoft SharePoint Server | EPSS exploit likelihood up 78 percentage points (0.80 now) |
| CVE-2026-3055 | Citrix NetScaler | EPSS exploit likelihood up 87 percentage points (0.91 now) |
| CVE-2026-104935 | Ivanti Connect Secure | EPSS exploit likelihood up 61 percentage points (0.87 now) |
Ransomware leak-site claims (20 of 285 shown, unverified)
- claimTOPLIVO ADUnverified claim. Claimed by N0n.
- claimTechnoleads Services Inc.Unverified claim. Claimed by N0n.
- claimPure Grow Diamonds Inc.Unverified claim. Claimed by N0n.
- claimMach Law APC (San Diego family law and divorce practice)Unverified claim. Claimed by N0n.
- claimKeidel Supply Company IncorporatedUnverified claim. Claimed by N0n.
- claimAndrews Advisory Group LLCUnverified claim. Claimed by N0n.
- claimTexcar Inc.Unverified claim. Claimed by N0n.
- claimGPIC Projectos Con Instalacoes LdaUnverified claim. Claimed by N0n.
- claimOoredoo MyanmarUnverified claim. Claimed by Qilin.
- claimWhite & CaseUnverified claim. Claimed by Qilin.
- claimHossner-Textil GmbHUnverified claim. Claimed by Qilin.
- claimECOMUnverified claim. Claimed by Qilin.
- claimETOUnverified claim. Claimed by Qilin.
- claimCastle Howard EstateUnverified claim. Claimed by Qilin.
- claimHeber City, UTUnverified claim. Claimed by Qilin.
- claimSLTN Inter AccessUnverified claim. Claimed by Qilin.
- claimM... C...Unverified claim. Claimed by Leakeddata.
- claimM...rUnverified claim. Claimed by Leakeddata.
- claimKirkland & Ellis LLPUnverified claim. Claimed by Leakeddata.
- claimK.r.a. ...sUnverified claim. Claimed by Leakeddata.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).