Daily Cybersecurity Briefing — October 21, 2026

6 days ago

8 min read

Wednesday, October 21, 2026

Your daily roundup of the most critical cybersecurity developments from the past 24–48 hours, curated for security practitioners and IT professionals.

🔴 ACTIVELY EXPLOITED VULNERABILITIES

PHP2Shell — CVE-2026-109618 & CVE-2026-109619 (CVSS 9.2): Two critical PHP core Remote Code Execution flaws patched today, October 21, 2026. These vulnerabilities allow attackers to execute arbitrary code via malicious multipart uploads on PHP 8 servers. Only PHP 8 receives patches. A public PoC is already in circulation. Emergency Nginx and Apache WAF rules (the php2shell ruleset) are available to block exploitation pre-patch. Immediate patching or WAF rule deployment is strongly recommended for all PHP-based web servers.
CISA KEV Update — Plex2Shell (CVE-2026-96652), Siemens DLL Sideloading, SiteGuard Command Injection: CISA added three new vulnerabilities to the Known Exploited Vulnerabilities catalog and ordered all FCEB agencies to patch. CVE-2026-96652 (Plex2Shell) enables unauthenticated remote code execution on Plex Media Server — attackers are using it to deploy cryptocurrency miners. The Siemens DLL sideloading flaw enables privilege escalation in industrial environments. The SiteGuard command injection flaw allows remote arbitrary command execution. FCEB patch deadlines apply for all three.
Palo Alto PAN-OS / Prisma Access — CVE-2026-0257 (MFA Bypass): Actively exploited by Qilin and INC ransomware groups since at least June 2026. The GlobalProtect flaw allows attackers to bypass multi-factor authentication and gain stealthy VPN access to corporate networks, serving as the initial access vector for ransomware deployment. Organizations running affected PAN-OS or Prisma Access versions should patch immediately.
CISA KEV — Fortinet & BeyondTrust Flaws: CISA added vulnerabilities in Fortinet and BeyondTrust products to the KEV catalog this month, reinforcing attacker focus on VPN and privileged access management (PAM) systems as primary enterprise entry points.

💥 BR3ACHES

ConnectWise Cloud Backup (SkyKick) Supply-Chain Breach — 173–300+ Microsoft 365 Tenants Compromised: Attackers exploited compromised OAuth credentials in ConnectWise's cloud backup platform (powered by SkyKick), gaining persistent unauthorized access to Microsoft 365 tenant data across 173 to 300+ organizations — primarily managed service providers (MSPs) and their downstream clients. ConnectWise has suspended its SaaS backup, security, and management services while investigating. Affected data includes M365 email, SharePoint, Teams, and OneDrive. MSPs using ConnectWise Cloud Backup should immediately audit OAuth application grants, review audit logs, and apply conditional access policies.
SafePay Ransomware — 600+ Critical Infrastructure Organizations Victimized: CISA and FBI issued a joint #StopRansomware advisory (AA26-293A) warning that SafePay ransomware has hit more than 600 critical infrastructure organizations since 2024, making it one of the most active ransomware operations tracked by federal law enforcement. SafePay exploits unpatched VPN appliances for initial access, then specifically targets and destroys Veeam backup servers before encrypting systems, severely hampering recovery. Sectors hit include energy, water, healthcare, and manufacturing.

🌐 THREATS & POLICY

KillSec Ransomware Gang Dismantled — 16-Year-Old Alleged Leader Arrested (Operation KillSwitch): Spanish National Police, as part of a coordinated international law enforcement operation, arrested a 16-year-old alleged to be the founder and leader of the KillSec ransomware group, along with two additional suspects. The group is believed responsible for more than 1,000 attacks worldwide. Servers were seized and the group's infrastructure disrupted. The case highlights the growing trend of juvenile cybercriminals leading sophisticated ransomware operations.
Ransomware Volume Surges 53% Year-Over-Year in 2026: Security research confirms ransomware attack volume has surged 53% year-over-year in 2026, driven by active groups including SafePay, Qilin, INC, and emerging threat actors. Critical infrastructure, healthcare, manufacturing, and education remain the most targeted sectors.
Trump Administration Announces Federal Crypto Scam Crackdown: President Trump is set to highlight a federal initiative targeting overseas cryptocurrency fraud operations as FBI complaint data shows a 17% year-over-year surge in crypto scam losses. The administration's crackdown targets transnational criminal networks operating pig-butchering scams and romance fraud schemes that have resulted in billions in U.S. victim losses.
ECSO Outlines EU Space Cybersecurity Policy Priorities: The European Cyber Security Organisation (ECSO) has outlined six priorities for EU space cybersecurity policy, including secure-by-design satellite systems and enhanced threat intelligence sharing between space agencies and the private sector — reflecting growing concern over adversarial threats to space-based infrastructure.

☁️ CLOUD & SAAS SECURITY

ConnectWise Cloud Backup — OAuth Supply-Chain Attack Exposes M365 Tenants: The ConnectWise breach (see BR3ACHES) demonstrates persistent risk in cloud backup supply chains. Attackers abused compromised OAuth credentials to gain persistent access across 173–300+ Microsoft 365 environments. M365 admins in MSP-managed environments should immediately audit third-party OAuth app grants in Entra ID (Azure AD), revoke suspicious grants, and enable alerts for abnormal OAuth token issuance.
Palo Alto Prisma Access (Cloud SASE) CVE-2026-0257 MFA Bypass Exploited: Cloud-delivered Prisma Access deployments are affected by CVE-2026-0257, the same PAN-OS MFA bypass flaw being actively exploited by ransomware groups. Organizations relying on Prisma Access for cloud-delivered security must treat this as a critical priority patch regardless of cloud-managed update schedules.

🔑 IDENTITY & AUTHENTICATION

CVE-2026-0257 — Palo Alto MFA Bypass Exploited by Qilin and INC Ransomware: The GlobalProtect VPN flaw actively being exploited by two major ransomware groups allows attackers to completely bypass multi-factor authentication protections, even where phishing-resistant MFA is configured. This represents a significant authentication control failure. Patch immediately; consider isolating GlobalProtect portals from the public internet where possible pending remediation.
Pass-the-Passkey Attacks — Phishing-Resistant MFA Bypasses in the Wild: Researchers continue documenting 'pass-the-passkey' techniques that recover synced passkey private keys or intercept authentication flows in Entra ID environments. Organizations implementing passkeys should mandate hardware-bound (FIDO2 security keys) rather than synced passkey implementations, and enforce device attestation to prevent private key extraction.
ConnectWise Breach — OAuth Credential Abuse Highlights Federated Identity Risks: The ConnectWise SkyKick incident illustrates the systemic risk of federated OAuth tokens in SaaS ecosystems. A single compromised OAuth credential granted attackers access to hundreds of downstream M365 tenants, underscoring the need for OAuth grant audits, minimum-permission scoping, and continuous token anomaly monitoring across cloud identity environments.

📱 MOBILE SECURITY

Low-Cost Android Phones Ship With Preinstalled Malware Disabling Google Play Protect: Thousands of inexpensive Android handsets are arriving factory-fresh with hidden malware that disables Google Play Protect and silently enrolls devices into residential proxy botnets. The infected devices are used to route malicious traffic through residential IP addresses, evading IP-based blocking. Organizations and employees purchasing low-cost Android devices from unverified retail sources should consider enterprise enrollment controls and MDM policy enforcement.
Zero-Click Spyware Delivered via Targeted Mobile Advertising: A documented threat campaign delivers zero-click spyware to iOS and Android devices via precision-targeted mobile advertising networks, requiring no user interaction. The spyware grants access to calls, messages, GPS location, and the device microphone. No universal patch exists. Users are advised to disable personalized ad tracking and keep operating systems fully updated.

🏭 ICS / OT / IoT SECURITY

SafePay Ransomware Targeting OT/ICS-Adjacent Critical Infrastructure: The CISA/FBI joint advisory on SafePay (AA26-293A) identifies targeted sectors with significant OT exposure including energy, water treatment, and manufacturing. SafePay's deliberate backup destruction strategy is particularly damaging to OT environments where restoration from backup is the primary recovery option.
Siemens DLL Sideloading Flaw Added to CISA KEV — Industrial Environments at Risk: A Siemens product DLL sideloading vulnerability is now on CISA's KEV list. Siemens equipment is heavily deployed across industrial control systems in manufacturing, energy, and utilities. FCEB agencies have been directed to patch; private-sector critical infrastructure operators should treat this as an urgent remediation priority.
MITRE ATT&CK v20 — Expanded Critical Infrastructure and OT Coverage: MITRE released ATT&CK v20, significantly expanding coverage of IT and OT attack techniques documented in real-world critical infrastructure attacks. The update adds new techniques observed in ICS/OT-specific incidents, providing defenders with a richer framework for assessing detection coverage gaps in OT environments.
Hacktivists and Cybercriminals Expand Attacks on ICS, OT, and AI Systems: New research from Industrial Cyber confirms that hacktivist groups and financially motivated cybercriminals are increasingly targeting internet-facing OT/ICS devices and AI systems embedded in critical infrastructure. The convergence of IT/OT attack surfaces — and the growing number of ICS devices exposed to the internet — continues to drive elevated risk across all critical sectors.

🔬 RESEARCH & TOOLS

PHP2Shell Public PoC Released for Security Testing: A proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) has been publicly released, dramatically increasing the risk window. Security teams should immediately deploy the php2shell Nginx/Apache WAF blocking ruleset and prioritize PHP 8 patching across all web-facing systems.
BigDiskBuster — New Technique Blocks Microsoft Defender Updates: Aviatrix researchers have documented 'BigDiskBuster,' a novel attack technique that exploits disk space exhaustion to prevent Microsoft Defender from downloading security definition updates, leaving endpoints silently unprotected while appearing operational. Security teams should implement disk space monitoring alerts on Defender-protected endpoints and deploy storage cleanup policies.
MITRE ATT&CK v20 Framework Released: The updated MITRE ATT&CK v20 framework expands coverage of critical infrastructure attack techniques with new IT and OT-specific entries drawn from recent incident data. Security operations teams should re-assess detection coverage using the updated framework, particularly for OT and ICS environments.

🤖 AI / SI SECURITY

U.S. Government Agencies Warn: AI Agents Could Exploit Security Flaws and Plant Backdoors: A formal inter-agency warning cautions that autonomous AI agents — systems granted access to APIs, file systems, databases, and network tools — could be manipulated by adversaries to exploit security vulnerabilities, establish persistent backdoors, or exfiltrate sensitive data. Recommended mitigations include strict least-privilege access for AI agents, behavioral monitoring, sandboxed execution environments, and human-in-the-loop approval for high-risk actions.
Microsoft Digital Defense Report 2026 — AI Giving Attackers a Decisive Head Start: Microsoft's 2026 Digital Defense Report documents how threat actors are deploying AI to accelerate attack reconnaissance, generate highly convincing phishing content, and discover software vulnerabilities faster than traditional patching cycles allow. The report calls for AI-assisted detection, response, and patch prioritization as a necessary defensive counterbalance.
Google AI Independently Discovers RCE-Class Vulnerabilities Attackers Most Want: Help Net Security reports that Google's AI research systems are now independently identifying remote code execution vulnerabilities in production software at scale — the same class of vulnerability most actively sought by threat actors. This capability asymmetry, where AI-assisted offensive research outpaces traditional defensive patching, represents a structurally growing risk requiring organizations to accelerate AI-assisted vulnerability management.
Palo Alto Unit 42 — 2026 Global Incident Response Report Confirms AI-Powered Intrusions Rising: The Unit 42 2026 Incident Response Report documents a sharp increase in AI-enabled attack campaigns including AI-generated spear-phishing, automated lateral movement, and AI-assisted evasion of endpoint detection and response (EDR) tools. Defenders are urged to implement AI-based behavioral anomaly detection to counter AI-driven attacker automation.
Weekly AI Security Intelligence Briefing (Week of Oct 19, 2026): This week's AI security landscape featured AI-powered intrusion campaigns, cloud compromises, and critical infrastructure vulnerabilities with AI-adjacent attack surface exposure. Full details in the TechJack Solutions and Cybersecurity Market weekly digests.

📰 Sources

The Hacker News — PHP2Shell: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

Phoenix.Security — PHP Core RCE CVE-2026-109618/109619: https://phoenix.security/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution/

The Hacker News — CISA Orders Federal Agencies to Patch Plex2Shell, Siemens, SiteGuard: https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html

CISA.gov — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 16): https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

The Hacker News — Qilin and INC Ransomware Exploit Palo Alto Networks Flaw to Bypass MFA: https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html

The Register — Palo Alto's firewall OS under attack from multiple ransomware groups since June: https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/

BleepingComputer — CISA: SafePay ransomware hit over 600 critical infrastructure orgs: https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/

CISA.gov — #StopRansomware: SafePay Ransomware (AA26-293A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

The Record — FBI says SafePay ransomware gang 'among most active' with 600+ victims: https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims

BleepingComputer — ConnectWise breach: Hackers breach Microsoft 365 tenants via supply-chain attack: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/

The Register — ConnectWise turns off SaaS backup and security services to probe SNAFU: https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/

The Hacker News — Police Arrest 16-Year-Old Suspected of Running KillSec Ransomware: https://thehackernews.com/2026/10/police-arrest-16-year-old-suspected-of.html

BleepingComputer — Police dismantle KillSec ransomware gang allegedly led by 16-year-old: https://bleepingcomputer.com/news/security/police-dismantle-killsec-ransomware-gang-allegedly-led-by-16-year-old

Tech Insider — Ransomware Surges 53% YoY as KillSec Arrest Made: https://tech-insider.org/ransomware-attacks-surge-53-percent-killsec-arrest-2026/

Crypto.news — Trump overseas crypto scam crackdown as FBI complaints surge 17%: https://crypto.news/trump-overseas-crypto-scam-crackdown-fbi-losses/

The Hacker News — Low-Cost Android Phones Ship With Preinstalled Malware (Residential Proxies): https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html

Gadget Review — Zero-Click Spyware Infecting Phones Through Targeted Ads: https://www.gadgetreview.com/zero-click-spyware-is-infecting-phones-through-targeted-ads

Industrial Cyber — Hacktivists and cybercriminals expand attacks on ICS, OT, and AI systems: https://industrialcyber.co/reports/hacktivists-and-cybercriminals-expand-attacks-on-ics-ot-and-ai-systems-across-critical-infrastructure/

Industrial Cyber — MITRE ATT&CK v20 expands critical infrastructure threat coverage: https://industrialcyber.co/industrial-cyber-attacks/mitre-attck-v20-expands-critical-infrastructure-threat-coverage-with-new-it-and-ot-attack-techniques/

Aviatrix — BigDiskBuster: Microsoft Defender Update Blocking Technique 2026: https://aviatrix.ai/threat-research-center/bigdiskbuster-microsoft-defender-update-blocking-2026/

GBHackers — U.S. Agencies Warn AI Agents Could Exploit Security Flaws and Establish Hidden Backdoors: https://gbhackers.com/u-s-agencies-warn-ai-agents/

Help Net Security — AI is giving attackers a head start, Microsoft warns: https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/

Help Net Security — The vulnerabilities AI finds are the ones attackers want: https://www.helpnetsecurity.com/2026/10/01/google-ai-discovered-vulnerabilities-remote-code-execution/

Palo Alto Networks — 2026 Unit 42 Global Incident Response Report: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report

Microsoft — Digital Defense Report 2026: https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/

SC World — CISA adds Fortinet and BeyondTrust vulnerabilities to exploited list: https://www.scworld.com/brief/cisa-adds-fortinet-and-beyondtrust-vulnerabilities-to-exploited-list

ComplianceHub.wiki — Pass-the-Passkey: When Phishing-Resistant MFA Stops Being a Compliance Answer: https://compliancehub.wiki/pass-the-passkey-entra-id-phishing-resistant-mfa-compliance-2026/